VLAN - Part -1 Virtual Local Area Networks

What is a VLAN?

        To refresh your memory, a Local Area Network (LAN) is a set of connected devices like computers, hubs, and switches sharing the same pool of logical address space. Normally, a router is required to route packets from one LAN to another LAN. Traditionally, all packets within a LAN are broadcast to all other devices connected to that particular LAN. 

 

As a result, a traditional LAN has several disadvantages as below:

• Usable bandwidth is shared among all the devices connected to the LAN
• ALL devices connected within a LAN can hear ALL the packets irrespective of whether the packet is meant for that device or not. It is possible for some unscrupulous node listening to data packets not meant for that.
• Suppose, your organization has different departments. Using a traditional LAN, when any changes take place within the organization, physical cables and devices need to be moved to reorganize the LAN infrastructure.
• A LAN cannot extend beyond its physical boundary across a WAN as in VLANs.

If you are looking for a simple networked solution for a small office, it may be a good idea to have a traditional LAN setup with a few hubs or switches. However, if you are planning for a large building or campus wide LAN for several individual departments, a VLAN is almost essential.

Virtual LANs (VLANs) can be considered as an intelligent LAN consisting of different physical LAN segments enabling them to communicate with each other as if they were all on the same physical LAN segment.

Benefits of VLAN: Several of the disadvantages of traditional LANs can be eliminated with the implementation of VLANs.

1. Improved Performance: In a traditional LAN, all the hosts within the LAN receive broadcasts, and contend for available bandwidth. As a result, the bandwidth is shared among all the connected devices within the LAN segment. If you are running high-bandwidth consumption applications such as groupware or server forms, a threshold point may easily be reached. After a threshold, the users may find the LAN too slow or un-responsive. With the use of VLAN, you can divide the big LAN into several smaller VLANs. For example, if there are two file servers, each operating at 100Mbps, in a traditional LAN both the servers have to share the LAN bandwidth of 100Mbps. If you put both the servers in separate VLANs, then both have an available bandwidth of 100Mbps each. Here the available bandwidth has been doubled.

2. Functional separation of an institute or a company: It is often required to separate the functional groups within a company or institute. For example, it might be necessary to separate HR department LAN from that of Production LAN. Traditionally, it requires a router to separate two physical LANs. However, you can set up two VLANs, one for Finance, and the other for Production without a router. A switch can route frames from one VLAN to another VLAN. With VLAN's it is easier to place a workgroup together eventhough they are physically in different buildings. In this case Finance VLAN does not forward packets to Production VLAN, providing additional security. 

3. Ease of Network Maintenance: 

Network maintenance include addition, removal, and changing the network users. With traditional LANs, when ever a User moves, it may be necessary to re-configure the user work station, router, and the servers. Some times, it may also be necessary to lay the cable, or reconfigure hubs and switches.  If you are using VLANs, many of these reconfiguration tasks become unnecessary. For example, you can avoid network address configuration on the work station and the corresponding router if you use VLAN. This is because, routing traffic within VLANs doesn't require a router.  

However, VLAN's add some administrative complexity, since the administration needs to manage virtual workgroups using VLANs. 

4. Reduced Cost

VLANs minimize the network administration by way of reduced maintenance on account of workstation addition/deletion/changes. This in turn reduce the costs associated with LAN maintenance.

5. Security

Using a LAN, all work stations within the LAN get the frames meant for all other work stations within the broadcast domain. Since a VLAN splits the broadcast domain into two or more, it is possible to put work stations sharing sensitive data in one VLAN, and other  work station in another VLAN. Of course, if two VLANs are not sufficient, you can split the work stations into as many VLANs as required. VLAN's can also be used to set up firewalls, restrict access, and send any intrusion alerts to the administrator. 

Example:

Question: Your network has 100 nodes on a single broadcast domain. You have implemented VLANs and segmented the network to have 2 VLANs of 50 nodes each. The resulting broadcast traffic effectively:

A. Increases two fold

B. Remains same

C. Decreases by half

D. Increases 4 fold

Ans: C

CISCO Access Control List (ACL)

The Cisco Access Control List (ACL) is are used for filtering traffic based on a given filtering criteria on a router or switch interface. Based on the conditions supplied by the ACL, a packet is allowed or blocked from further movement. Cisco ACLs are available for several types of routed protocols including IP, IPX, AppleTalk, XNS, DECnet, and others. However, we will be discussing ACLs pertaining to TCP/IP protocol only.  ACLs for TCP/IP traffic filtering are primarily divided into two types: Standard Access Lists, and Extended Access Lists

Standard Access Control Lists: Standard IP ACLs range from 1 to 99. A Standard Access List  allows you to permit or deny traffic FROM specific IP addresses. The destination of the packet and the ports involved can be anything.

This is the command syntax format of a standard ACL.

access-list access-list-number {permit|deny}
{host|source source-wildcard|any}

Standard ACL example:

access-list 10 permit 192.168.2.0 0.0.0.255

This list allows traffic from all addresses in the range 192.168.2.0 to 192.168.2.255

Note that when configuring access lists on a router, you must identify each access list uniquely by assigning either a name or a number to the protocol's access list.

There is an implicit deny added to every access list. If you entered the command:

show access-list 10

The output looks like:

access-list 10 permit 192.168.2.0 0.0.0.255
access-list 10 deny any

Extended Access Control Lists: Extended IP ACLs allow you to permit or deny traffic from specific IP addresses to a specific destination IP address and port. It also allows you to have granular control by specifying controls for different types of protocols such as ICMP, TCP, UDP, etc within the ACL statements. Extended IP ACLs range from 100 to 199. In Cisco IOS Software Release 12.0.1, extended ACLs began to use additional numbers (2000 to 2699).

The syntax for IP Extended ACL is given below:

access-list access-list-number {deny | permit} protocol source source-wildcard
destination destination-wildcard [precedence precedence]

Note that the above syntax is simplified, and given for general understanding only.

Extended ACL example:

access-list 110 - Applied to traffic leaving the office (outgoing)

access-list 110 permit tcp 92.128.2.0 0.0.0.255 any eq 80

ACL 110 permits traffic originating from any address on the 92.128.2.0 network. The 'any' statement means that the traffic is allowed to have any destination address with the limitation of going to port 80. The value of 0.0.0.0/255.255.255.255 can be specified as 'any'.

Applying an ACL to a router interface:

After the ACL is defined, it must be applied to the interface (inbound or outbound). The syntax for applying an ACL to a router interface is given below:

interface <interface>
ip access-group {number|name} {in|out}

An Access List may be specified by a name or a number. "in" applies the ACL to the inbound traffic, and "out" applies the ACL on the outbound traffic.

Example:

To apply the standard ACL created in the previous example, use the following commands:

Rouer(config)#interface serial 0
Rouer(config-if)#ip access-group 10 out

Example Question:

Which command sequence will allow only traffic from network 185.64.0.0 to enter interface s0?

A. access-list 25 permit 185.64.0.0 255.255.0.0
int s0 ; ip access-list 25 out

B. access-list 25 permit 185.64.0.0 255.255.0.0
int s0 ; ip access-group 25 out

C. access-list 25 permit 185.64.0.0 0.0.255.255
int s0 ; ip access-list 25 in

D. access-list 25 permit 185.64.0.0 0.0.255.255
int s0 ; ip access-group 25 in

Correct answer: D

Explanation:

The correct sequence of commands are:
1. access-list 25 permit 185.64.0.0 0.0.255.255
2. int s0
3. ip access-group 25 in

CISCO IOS An Introducton

Cisco IOS (short for Internetwork Operating System) is the software used on a majority of Cisco Systems routers and switches.  IOS consists of routing, switching, internetworking and telecommunications functions in a multitasking operating system.  Cisco IOS has uses command line interface (CLI), and provides a fixed set of multiple-word commands. A Cisco IOS command line interface can be accessed through either a console connection, modem connection, or a telnet session. The set of commands available at any particular level is determined by the "mode" and the privilege level of the current user.  Cisco IOS follows a command hierarchy, with each level offering different set of commands  All commands are assigned a privilege level, from 0 to 15, and can only be accessed by users with the necessary privilege. Through the CLI, the commands available to each privilege level can be defined.

Some of the widely used command hierarchy levels are given below:

User EXEC level: This is the level that a connected user is allowed initially. User EXEC allows access to a limited set of basic monitoring commands. A ">" sign denotes User EXEC mode.

Privileged EXEC level: Privileged EXEC level allows access to all router commands including router configuration and management commands. This level is usually password protected for security reasons. A "#"sign denotes privileged EXEC mode.

When a user is connected to a Cisco IOS, a User EXEC prompt appears. Now, the user can enter privileged EXEC mode by typing the password shown as below:

Router> enable
Password: [enable password]
Router# configure terminal
Router(config)#

Global configuration mode: "Global configuration mode" provides commands to change the system's configuration. This is typically represented by "(config)#" sign as shown in the above example.

Interface configuration mode: "Interface configuration mode" provides commands to change the configuration of a specific interface of the router.  An interface configuration mode is denoted by "(config-in)#".

A summary of Cisco IOS router command prompt is given below:

Prompt	Explanation
Router>	User EXEC mode
Router#	Privileged EXEC mode
Router(config)#	Global configuration mode. # sign indicates this is only accessible at privileged EXEC mode.
Router(config-if)#	Interface level configuration mode.
Router(config-router)#	Routing engine level within configuration mode.
Router(config-line)#	Line level (vty, tty, async) within configuration mode.

Context Sensitive Help

Cisco IOS CLI offers context sensitive help. At any time during an EXEC session, a user can type a question mark (?) to get help.

Two types of context sensitive help are available:

• Word help and
• Command syntax help.

Word help: Word help can be used to obtain a list of commands that begin with a given character string. To use word help, type in the characters in question followed immediately by the question mark (?).  The following is an example of word help:

Router# co?
configure connect copy

Command syntax help: Command syntax help can be used to obtain a list of commands, keyword, or argument options that are available starting with the keywords that the user had already entered. To use command syntax help, enter a question mark (?) after hitting a space.  The router will then display a list of available command options with <cr> standing for carriage return. The following is an example of command syntax help:

Router# configure ?
memory Configure from NV memory
network Configure from a TFTP network host
terminal Configure from the terminal
<cr>

Cisco IOS also allows abbreviated commands support. For example, consider the following:

Router#configure terminal
Router(config)#

Router#config term
Router(config)#

Both the above commands to the same job. The IOS correctly interprets the full command words. However, if there is any ambiguity, an error message is generated as below:

Router(config)#c
% Ambiguous command: "c"

Checkout a ccna router simulator available from certexams.com.

Example Question: 

What is the command used to add a banner to a Cisco router configuration?

A. add banner

B. banner motd #

C. motd banner #

D. add banner #

Correct answer: B

Explanation:

The banner is displayed whenever anyone logs in to your Cisco router. The syntax is

"banner motd # 

MOTD stands for "Message Of The Day".

# symbol signifies the start of the banner message to the router. You will be prompted for the

message to be displayed. You need to enter "#" symbol at the end of the message, signifying

that the msg has ended.

Alternatively, you can enter the banner in the same line as below:

"banner motd # your message here#

note that you need to begin and end the banner with a delimiter (here # sign).

Subnet Masking - Part - 2

What we discussed in the previous section is Classful subnet masking. A Subnetmask normally contains the host portion of the bits also. This is called Classless Inter Domain Routing (CIDR). This will enable more networks for a given class of network address. For example, allowing 3 host bits towards subnet portion in our previous IP address, will allow us to offer 2X2X2 or 8 additional subnetworks. Traditionally, all zeros, and all ones subnets are not used, and hence we are left with 6 subnets.

192.189.210.078: 1100 0000.1011 1101.1101 0010.0100 1110 Class C IP Address

255.255.255.224: 1111 1111.1111 1111.1111 1111.1110 0000 Class C subnet mask with 3 additional bits of host portion used for Subnetting. 

Broadcast address: 1100 0000.1011 1101.1101 0010.0101 1111 :192.189.210.95

The above is the broadcast address for a given subnet (192.189.210.078). Under Classful routing, the broadcast address would have been 192.189.210.255.

Note that by using Subnetting, we are able to increase the number of networks available within a given IP address. On the otherhand, we will be loosing the number of hosts available within a subnet to 2⁴  or 16 hosts per subnet. Again, all zeros, and all ones host addresses are traditionally reserved for other purposes.

CIDR (Classless InterDomain Routing) notation: Subnet mask is also represented as below:

192.189.210.078/27, where 27 is the number of bits in the network portion of the IP address.

Why use CIDR?

Normally, ISPs allocate the IP addresses for individuals or Corporates.  The reason being that it is almost impossible to allocate a classful IP address to every individual or a corporate. Using CIDR, the biggest ISPs are given large pool of IP address space. The ISP's customers such as individual or Corporates are then allocated networks from the big ISP's pool. This kind of arrangement will enable efficient management and utilization of the Internet.

Classful addresses can easily be written in CIDR notation

Class A =  A.B.C.D/8, Class B = A.B.C.D/16, and Class C = A.B.C.D/24

Where A,B,C,D are dotted decimal octets.

Example Question:

You have an IP of 156.233.42.56 with a subnet mask of 7 bits. How many hosts and subnets are possible?

A. 126 hosts and 510 subnets

B. 128 subnets and 512 hosts

C. 510 hosts and 126 subnets

D. 512 subnets and 128 hosts

 

Correct answer: C

Explanation:

Class B network has the form N.N.H.H, the default subnet mask is 16 bits long.

There is additional 7 bits to the default subnet mask. The total number of bits in subnet are 16+7 = 23.

This leaves us with 32-23 =9 bits for assigning to hosts.

7 bits of subnet mask corresponds to (2^7-2)=128-2 = 126 subnets.

9 bits belonging to host addresses correspond to (2^9-2)=512-2 = 510 hosts.

Subnet Masking - Part - 1

 

Subnetting an IP Network is done primarily for better utilization of available IP address space, and routing purpose. Other reasons include better organization, use of different physical media (such as Ethernet, WAN, etc.),  and securing network resources. A subnet mask enables you to identify the network and node parts of the address. The network bits are represented by the 1s in the mask, and the node bits are represented by the 0s. A logical AND operation between the IP address and the subnet mask provides the Network Address.

For example, using our test IP address and the default Class C subnet mask, we get:

192.189.210.078: 1100 0000.1011 1101.1101 0010.0100 1110 Class C IP Address

255.255.255.000: 1111 1111.1111 1111.1111 1111.0000 0000 Default Class C subnet mask

 192.189.210.0         1100 0000 1011 1101 1101 0010 0000 0000

As can be seen above, by using and AND operator, we can compute the network portion of an IP address.  The network portion for the IP address given in the above example is 192.189.210.0, and the host portion of the IP address is 078.

Given below is a table that provides binary equivalent of decimal values. 

For binary conversion, take first octet of a given IP address (in dotted decimal form), and lookup the binary value. Then take the second octet and lookup the binary value, and so on.

Binary Conversion Table

Decimal	Binary	Decimal	Binary	Decimal	Binary	Decimal	Binary
0	0000 0000	64	0100 0000	128	1000 0000	192	1100 0000
1	0000 0001	65	0100 0001	129	1000 0001	193	1100 0001
2	0000 0010	66	0100 0010	130	1000 0010	194	1100 0010
3	0000 0011	67	0100 0011	131	1000 0011	195	1100 0011
4	0000 0100	68	0100 0100	132	1000 0100	196	1100 0100
5	0000 0101	69	0100 0101	133	1000 0101	197	1100 0101
6	0000 0110	70	0100 0110	134	1000 0110	198	1100 0110
7	0000 0111	71	0100 0111	135	1000 0111	199	1100 0111
8	0000 1000	72	0100 1000	136	1000 1000	200	1100 1000
9	0000 1001	73	0100 1001	137	1000 1001	201	1100 1001
10	0000 1010	74	0100 1010	138	1000 1010	202	1100 1010
11	0000 1011	75	0100 1011	139	1000 1011	203	1100 1011
12	0000 1100	76	0100 1100	140	1000 1100	204	1100 1100
13	0000 1101	77	0100 1101	141	1000 1101	205	1100 1101
14	0000 1110	78	0100 1110	142	1000 1110	206	1100 1110
15	0000 1111	79	0100 1111	143	1000 1111	207	1100 1111
16	0001 0000	80	0101 0000	144	1001 0000	208	1101 0000
17	0001 0001	81	0101 0001	145	1001 0001	209	1101 0001
18	0001 0010	82	0101 0010	146	1001 0010	210	1101 0010
19	0001 0011	83	0101 0011	147	1001 0011	211	1101 0011
20	0001 0100	84	0101 0100	148	1001 0100	212	1101 0100
21	0001 0101	85	0101 0101	149	1001 0101	213	1101 0101
22	0001 0110	86	0101 0110	150	1001 0110	214	1101 0110
23	0001 0111	87	0101 0111	151	1001 0111	215	1101 0111
24	0001 1000	88	0101 1000	152	1001 1000	216	1101 1000
25	0001 1001	89	0101 1001	153	1001 1001	217	1101 1001
26	0001 1010	90	0101 1010	154	1001 1010	218	1101 1010
27	0001 1011	91	0101 1011	155	1001 1011	219	1101 1011
28	0001 1100	92	0101 1100	156	1001 1100	220	1101 1100
29	0001 1101	93	0101 1101	157	1001 1101	221	1101 1101
30	0001 1110	94	0101 1110	158	1001 1110	222	1101 1110
31	0001 1111	95	0101 1111	159	1001 1111	223	1101 1111
32	0010 0000	96	0110 0000	160	1010 0000	224	1110 0000
33	0010 0001	97	0110 0001	161	1010 0001	225	1110 0001
34	0010 0010	98	0110 0010	162	1010 0010	226	1110 0010
35	0010 0011	99	0110 0011	163	1010 0011	227	1110 0011
36	0010 0100	100	0110 0100	164	1010 0100	228	1110 0100
37	0010 0101	101	0110 0101	165	1010 0101	229	1110 0101
38	0010 0110	102	0110 0110	166	1010 0110	230	1110 0110
39	0010 0111	103	0110 0111	167	1010 0111	231	1110 0111
40	0010 1000	104	0110 1000	168	1010 1000	232	1110 1000
41	0010 1001	105	0110 1001	169	1010 1001	233	1110 1001
42	0010 1010	106	0110 1010	170	1010 1010	234	1110 1010
43	0010 1011	107	0110 1011	171	1010 1011	235	1110 1011
44	0010 1100	108	0110 1100	172	1010 1100	236	1110 1100
45	0010 1101	109	0010 1101	173	1010 1101	237	1010 1101
46	0010 1110	110	0110 1110	174	1010 1110	238	1110 1110
47	0010 1111	111	0110 1111	175	1010 1111	239	1110 1111
48	0011 0000	112	0111 0000	176	1011 0000	240	1111 0000
49	0011 0001	113	0111 0001	177	1011 0001	241	1111 0001
50	0011 0010	114	0111 0010	178	1011 0010	242	1111 0010
51	0011 0011	115	0111 0011	179	1011 0011	243	1111 0011
52	0011 0100	116	0111 0100	180	1011 0100	244	1111 0100
53	0011 0101	117	0111 0101	181	1011 0101	245	1111 0101
54	0011 0110	118	0111 0110	182	1011 0110	246	1111 0110
55	0011 0111	119	0111 0111	183	1011 0111	247	1111 0111
56	0011 1000	120	0111 1000	184	1011 1000	248	1111 1000
57	0011 1001	121	0111 1001	185	1011 1001	249	1111 1001
58	0011 1010	122	0111 1010	186	1011 1010	250	1111 1010
59	0011 1011	123	0111 1011	187	1011 1011	251	1111 1011
60	0011 1100	124	0111 1100	188	1011 1100	252	1111 1100
61	0011 1101	125	0111 1101	189	1011 1101	253	1111 1101
62	0011 1110	126	0111 1110	190	1011 1110	254	1111 1110
63	0011 1111	127	0111 1111	191	1011 1111	255	1111 1111

Example Question: Which of the following is a Class C IP address?

A. 10.10.14.118       B. 135.23.112.57       C. 191.200.199.199       D. 204.67.118.54

                          

Correct Answer: D.

Explanation:

IP addresses are written using decimal numbers separated by decimal points. This is called dotted decimal notation of expressing IP addresses. The different classes of IP addresses is as below:

Class	Format	Leading Bit  pattern	Network address Range	Maximum  networks	Maximum hosts
A	N.H.H.H	0	0-126	127	16,777,214
B	N.N.H.H	10	128-191	16,384	65,534
C	N.N.N.H	110	192-223	2,097,152	254

Network address of all zeros means "This network or segment".

Network address of all 1s means " all networks", same as hexadecimal of all Fs.

Network number 127 is reserved for loopback tests.

Host (Node) address of all zeros mean "This Host (Node)".

Host (Node) address of all 1s mean "all Hosts (Nodes) " on the specified network.

 

IP Addressing

An IP address is a unique logical identifier for a node or host connection on an IP network. An IP address is a 32 bit binary number, and represented as 4 decimal values of 8 bits each. The decimal values range from 0 to 255. This is known as "dotted decimal" notation. Example: 192.189.210.078 It is sometimes useful to view the values in their binary form. 192     .189     .210     .078 11000000.10111101.11010010.1001110

Every IP address consists of network identifier and node identifier. The IP network is divided based on Class of network. The class of network is determined by the leading bits of the IP address as shown below. 

Address Classes

There are 5 different address classes. You can determine which class any IP
address is in by examining the first 4 bits of the IP address.

• Class A addresses begin with 0xxx, or 1 to 126 decimal.
  
• Class B addresses begin with 10xx, or 128 to 191 decimal.
  
• Class C addresses begin with 110x, or 192 to 223 decimal.
  
• Class D addresses begin with 1110, or 224 to 239 decimal.
  
• Class E addresses begin with 1111, or 240 to 254 decimal.
  

Addresses beginning with 01111111, or 127 decimal, are reserved for loopback and for internal testing on a local machine. Class D addresses are reserved for multicasting. Class E addresses are reserved for future use. They should not be used for host addresses.

Now we can see how the Class determines, by default, which part of the IP address belongs to the network (N) and which part belongs to the Host/node (H).

• Class A: NNNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH
  
• Class B: NNNNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH
  
• Class C: NNNNNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH
  

In the example, 192.189.210.078 is a Class C address so by default the Network part of the address (also known as the Network Address) is defined by the first three octets (192.189.210.XXX) and the node part is defined by the last one octets (XXX.XXX.XXX.078).

In order to specify the network address for a given IP address, the node section is set to all "0"s. In our example, 192.189.210.0 specifies the network address for 192.189.210.078. When the node section is set to all "1"s, it specifies a broadcast that is sent to all hosts on the network. 192.189.210.255 specifies the broadcast address.

Private Subnets

There are three IP network addresses reserved for private networks. The addresses are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They can be used by anyone setting up internal IP networks, such as an intranet. Internet routers never forward the private addresses over the public Internet.

CCNA Tutorials - Part - 1

Download Link :

 

http://www.ziddu.com/download/4609258/CCNATUTORIALS-PART1.pdf.html