ccna dis3 - chapter 7 - implementing enterprise wan links_ppt [compatibility mode]

8/3/2019 CCNA Dis3 - Chapter 7 - Implementing Enterprise WAN Links_ppt [Compatibility Mode]

1/101

Chapter 7 Implementing EnterpriseWAN links

CCNA Discovery 4.0


2/101

Intruduction

Hc vin cng ngh thng tin Bach Khoa - Website: www.bkacad.com
http://www.bkacad.com/http://www.bkacad.com/


3/101

Intruduction



4/101

Intruduction



5/101


Objectives


6/101


Connecting theEnterprise WAN


7/101


WAN Devices and Technology

A WAN is a data communications network that operates beyond the geographicscope of a LAN.

WANs generally carry a variety of traffic types, such as voice, data, and video. Here are the three major characteristics of WANs:

1. Connect devices that are separated by a broader geographical area.

2. Use the services of carriers, such as telephone or cable companies,

satellite system3. Use serial connections


8/101

Hc vin mng Bach Khoa - Website: www.bkacad.com 8


WANs and the OSI Model As described in relation to the OSI reference model, WAN operations

focus primarily on Layer 1 and Layer 2.

WAN access standards typically describe both physical layer deliverymethods and data link layer requirements, including physical

addressing, flow control, and encapsulation.


9/101



WAN Physical Layer Terminology The figure illustrates the terminology commonly used to describe physical WAN

connections, including:

Customer Premises Equipment (CPE)

Data Communications Equipment (DCE)

Data Terminal Equipment (DTE)

Demarcation Point

Local Loop

Central Office (CO)


10/101


WAN Physical Layer Terminology Customer Premises Equipment (CPE)-Terminal Equipment, such as

terminals, telephones, and modems, supplied by the telephone company,installed at customer site, and connected to the telephone companynetwork.

Data communications equipment (DCE) or Data circuit-terminating

equipment. The devices and connections of a communications networkthat comprise the network end of the user to network interface. TheDCE provides a physical connection to the network, forward traffic, andprovides clocking signal used to synchronize data transmission betweenDCE and DTE devices. Modems and interface cards are examples of DCE

Device Terminal Equipment (DTE): Device at the user end of a user -

network interface that serves as data source, destination, or both. DTEconnects to a data network through a DCE device (for example, modem)and typically uses clocking signals generated by the DCE. DTE includessuch as computers, multiplexers.



11/101


Demarcation Point-A point established in a building or complex to separatecustomer equipment from service provider equipment. Physically, thedemarcation point is the cabling junction box, located on the customerpremises, that connects the CPE wiring to the local loop. It is usually placed foreasy access by a technician. The demarcation point is the place where theresponsibility for the connection changes from the user to the service provider.

This is very important because when problems arise, it is necessary todetermine whether the user or the service provider is responsible fortroubleshooting or repair.

Local Loop-The copper or fiber telephone cable that connects the CPE at thesubscriber site to the CO of the service provider. The local loop is alsosometimes called the "last-mile."

Central Office (CO)-A local service provider facility or building where localtelephone cables link to long-haul, all-digital, fiber-optic communications linesthrough a system of switches and other equipment.



12/101



WAN Devices WANs use numerous types of devices that are specific to WAN

environments, including:

Modem

CSU/DSU

Access server WAN switch

Router

Core router


13/101


CSU/DSU-Digital lines, such as T1 or T3 carrier lines, require a channel serviceunit (CSU) and a data service unit (DSU). The two are often combined into a singlepiece of equipment, called the CSU/DSU. The CSU provides termination for thedigital signal and ensures connection integrity through error correction and linemonitoring. The DSU converts the T-carrier line frames into frames that the LANcan interpret and vice versa.

WAN switch-A multiport internetworking device used in carrier networks. Thesedevices typically switch traffic such as Frame Relay, ATM, or X.25, and operate at

the data link layer of the OSI reference model. Public switched telephone network(PSTN) switches may also be used within the cloud for circuit-switched

connections like Integrated Services Digital Network (ISDN) or analog dialup. Access server-Concentrates dial-in and dial-out user communications. An access

server may have a mixture of analog and digital interfaces and support hundredsof simultaneous users.

WAN switch-A multiport internetworking device used in carrier networks. Thesedevices typically switch traffic such as Frame Relay, ATM, or X.25, and operate atthe data link layer of the OSI reference model. Public switched telephone network(PSTN) switches may also be used within the cloud for circuit-switchedconnections like Integrated Services Digital Network (ISDN) or analog dialup.



14/101



WAN Physical Layer Standards WAN physical-layer protocols describe how to provide electrical,

mechanical, operational, and functional connections for WAN services.The WAN physical layer also describes the interface between the DTEand the DCE.


15/101


16/101



WAN Physical Layer Standards


17/101




18/101




19/101


WAN Standards

Several organizations are

responsible for managing both

the Physical Layer and Data-

link Layer WAN standards.

These include:

1. International

Telecommunications UnionTelecommunications

Standardization Sector

(ITU-T)

2. International Organization

for Standardization (ISO)

3. Internet Engineering Task

Force (IETF)

4. Electronics Industry

Alliance (EIA)

5. Telecommunications

Industry Association (TIA)


20/101


WAN Standards

Activity


21/101


Access WAN

With analog connections, the data is encoded, or modulated, onto acarrier wave.

A modem encodes the information onto that carrier wave beforetransmission and then decodes it at the receiving end.


22/101


Access WAN

There are two techniques in which information from multiplechannels can be allocated bandwidth on a single cable based on

time: Time Division Multiplexing (TDM) and Statistical Time

Division Multiplexing (STDM).


23/101


Access WAN


24/101


Access WAN


25/101


Access WAN

Activity


26/101


Packet and Circuit Switching


27/101



Circuit Switching A circuit-switched network is one that establishes a dedicated circuit

(or channel) between nodes and terminals before the users maycommunicate.

The internal path taken by the circuit between exchanges is shared by

a number of conversations. Time division multiplexing (TDM) giveseach conversation a share of the connection in turn. TDM assures thata fixed capacity connection is made available to the subscriber.

PSTN and ISDN are two types of circuit-

switching technology that may be used to

implement a WAN in an enterprise setting.


28/101



Packet Switching In contrast to circuit switching, packet switching splits traffic data into

packets that are routed over a shared network. Packet-switchingnetworks do not require a circuit to be established, and they allowmany pairs of nodes to communicate over the same channel.

There are two approaches to this link determination, connectionless orconnection-oriented.


29/101



Packet Switching A VC is a logical circuit created within a shared network between two

network devices

Permanent Virtual Circuit (PVC)-A permanently established virtualcircuit that consists of one mode: data transfer.

PVCs are used in situations in which data transfer between devicesis constant.

PVCs decrease the bandwidth use associated with establishingand terminating VCs, but they increase costs because of constantvirtual circuit availability.

PVCs are generally configured by the service provider when anorder is placed for service.

Switched Virtual Circuit (SVC)-A VC that is dynamically established ondemand and terminated when transmission is complete.

Communication over an SVC consists of three phases: circuitestablishment, data transfer, and circuit termination.


30/101



Cell Switching It is capable of transferring voice, video, and data

through private and public networks at speeds inexcess of 155 Mbps.

Asynchronous Transfer Mode (ATM) uses fixedlength, 53-byte cells that have 48-bytes of data and a5-byte header.


31/101




32/101


Last mile and long range WAN technologies

Some common lastmile technologies are:

Analog dialup

Integrated Services

Digital Network(ISDN)

Leased line

Cable

Digital SubscriberLine (DSL)

Frame Relay

Wireless


33/101



Synchronous Optical Network (SONET) and Synchronous DigitalHierarchy (SDH) are standards that allow the movement of largeamounts of data over great distances through fiber-optic cables.

Both SONET and SDH encapsulate earlier digital transmissionstandards and support either ATM or Packet over SONET/SDH (POS)networking. SDH and SONET are used for moving both voice and

data.

One of the newer developments for extremely long-rangecommunications is dense wavelength division multiplexing (DWDM).

DWDM assigns incoming optical signals to specific frequencies orwavelengths of light. It is also capable of amplifying these wavelengths

to boost the signal strength. DWDM can multiplex more than 80 different wavelengths or channels

of data onto a single piece of fiber.

Each channel is capable of carrying a multiplexed signal at 2.5 Gbps.


34/101




35/101


ComparingCommon WAN

Encapsulation


36/101


Ethernet and WAN Encapsulations


37/101




38/101




39/101


40/101

Hc vin Cng ngh thng tin Bach Khoa - Website:www.bkacad.com 40

HDLC and PPP

HDLC uses synchronous serial

transmission to provide error-free

communication between two points.

HDLC defines a Layer 2 framing

structure that allows for flow control

and error control through the use of

acknowledgments.


41/101


HDLC and PPP

What is PPP? Cisco HDLC is the default serial

encapsulation method when youconnect two Cisco routers.

When you need to connect to anon-Cisco router, you should usePPP encapsulation.

PPP establishes a directconnection using serial cables,

phone lines, trunk lines, cellulartelephones, specialized radio links,or fiber-optic links.

There are many features notavailable in HDLC:

The link quality managementfeature monitors the quality ofthe link. If too many errors are

detected, PPP takes the linkdown. PPP supports PAP and CHAP

authentication. This feature isexplained and practiced in alater section.

PPP contains 3 main components:

1. HDLC protocol for encapsulating

datagrams over point-to-point links.

2. Extensible Link Control Protocol

(LCP) to establish, configure, and test

the data link connection.

3. Family of Network Control Protocols

(NCPs) for establishing and

configuring different network layer
http://www.bkacad.com/http://www.bkacad.com/http://www.bkacad.com/


42/101


HDLC and PPP

At the physical layer, you can configure PPP on a range of interfaces,including: Asynchronous serial Synchronous serial HSSI ISDN


43/101


HDLC and PPP

The LCP provides automatic configuration of the interfaces at each end, including: Handling varying limits on packet size Detecting common misconfiguration errors Terminating the link Determining when a link is functioning properly or when it is failing

PPP also uses the LCP to agree automatically on encapsulation formats (authentication,compression, error detection) as soon as the link is established.


44/101


HDLC and PPP

NCPs include

functional fieldscontaining

standardized codes

(PPP protocol field

numbers shown in

the figure) to


45/101


HDLC and PPP


46/101


HDLC and PPP

Phase 1: Link establishment and configuration negotiation This phase is complete when the receiving router sends a configuration-

acknowledgment frame back to the router initiating the connection.

Phase 2: Link quality determination (optional) Phase 3: Network layer protocol configuration negotiation


47/101


HDLC and PPP

1. Link establishment - (LCPs)

2. Authentication - Optional (LCPs)

3. Link quality determination - Optional (LCPs)

4. Network layer protocol configuration (NCPs)

5. Link termination (LCPs)


48/101


HDLC and PPP

LCP operation uses three classes of LCP frames to accomplish the work of each of theLCP phases: Link-establishment frames establish and configure a link (Configure-Request,

Configure-Ack, Configure-Nak, and Configure-Reject) Link-maintenance frames manage and debug a link (Code-Reject, Protocol-Reject,

Echo-Request, Echo-Reply, and Discard-Request) Link-termination frames terminate a link (Terminate-Request and Terminate-Ack)


49/101


HDLC and PPP

During link maintenance, LCP can use messages to provide feedbackand test the link: Code-Reject and Protocol-Reject - These frame types provide

feedback when one device receives an invalid frame due to eitheran unrecognized LCP code (LCP frame type) or a bad protocolidentifier. For example, if an un-interpretable packet is receivedfrom the peer, a Code-Reject packet is sent in response.

Echo-Request, Echo-Reply, and Discard-Request - These framescan be used for testing the link.

If the LCP terminates the link before the NCP, the NCP session is alsoterminated.

The device initiating the shutdown sends a Terminate-Requestmessage.

The other device replies with a Terminate-Ack. A termination requestindicates that the device sending it needs to close the link.


50/101


HDLC and PPP


51/101


HDLC and PPP


52/101


HDLC and PPP


53/101


HDLC and PPP

PPP can be configured to support various functions including:1. Authentication using either PAP or CHAP2. Compression using either Stacker or Predictor3. Multilink which combines two or more channels to increase the

WAN bandwidth


54/101


HDLC and PPP

To negotiate the use of these PPP options, the LCP link-establishment frames contain Option information in theData field of the LCP frame.

If a configuration option is not included in an LCP frame,

the default value for that configuration option is assumed.


55/101


HDLC and PPP

Although initially designed for IP datagrams, PPP can carrydata from many types of network layer protocols by using amodular approach in its implementation.

It can also carry two or more Layer 3 protocolssimultaneously.

Its modular model allows the LCP to set up the link andthen hand the details of a network protocol to a specificNCP

Each network protocol has a corresponding NCP.

Each NCP has a corresponding RFC. There are NCPs forIP, IPX, AppleTalk, and many others. NCPs use the samepacket format as the LCPs.


56/101


HDLC and PPP


57/101


HDLC and PPP

IPCP negotiates two options:Compression - Allows devices to negotiate an algorithm

to compress TCP and IP headers and save bandwidth.

Van Jacobson TCP/IP header compression reducesthe size of the TCP/IP headers to as few as 3 bytes.

This can be a significant improvement on slow seriallines, particularly for interactive traffic.

IP-Address - Allows the initiating device to specify an IPaddress to use for routing IP over the PPP link, or to

request an IP address for the responder. Dialup network links commonly use the IP address

option.


58/101


HDLC and PPP


59/101


Configuring PPP


60/101


PPP Configuration Options

PPP may include the following LCP options: Authentication Compression Error Detection Multilink PPP Callback


61/101


PPP Configuration Commands

The percentages are calculated for both incomingand outgoing directions.

.

1. Link Quality

Monitoring

(LQM)

2. Use theno ppp

quality command

to disable LQM.


62/101


PPP Configuration Commands

Example 1: Enabling PPP on an Interface R3#configure terminal R3(config)#interface serial 0/0 R3(config-if)#encapsulation ppp

Example 2: Compression R3(config)#interface serial 0/0

R3(config-if)#encapsulation ppp R3(config-if)#compress [predictor | stac]

Example 3: Link Quality Monitoring R3(config)#interface serial 0/0 R3(config-if)#encapsulation ppp R3(config-if)#ppp quality 80

Example 4: Load Balancing Across Links Router(config)#interface serial 0/0 Router(config-if)#encapsulation ppp Router(config-if)#ppp multilink


63/101


Verifying a Serial PPP Encapsulation Configuration


64/101


Troubleshooting PPP Encapsulation


65/101




66/101




67/101




68/101


PPP Authentication Protocols

The authentication phase of a PPP session is optional. If used, you canauthenticate the peer after the LCP establishes the link and choose theauthentication protocol. If it is used, authentication takes place beforethe network layer protocol configuration phase begins.

PAP is a very basic

two-way process.

There is no

encryption-the

username andpassword are sent in

plain textCHAP is more secure

than PAP. It involves a

three-way exchange of

a shared secret.


69/101


Password Authentication Protocol (PAP)

CHAP conducts

periodic challenges

to make sure that theremote node still has

a valid password

value. The password

value is variable and

chan es


70/101


Challenge Handshake Authentication Protocol (CHAP)

Initiating CHAP

Responding CHAP

Completing CHAP


71/101


PPP Encapsulation and Authentication Process


72/101



CallThe call come into 3640-1. The incoming interface is

configured with the ppp authentication chap command

LCP negotiates CHAP and MD5

CHAP challenge from 3640-1 to the calling router isrequired on this call


73/101



Challenge A CHAP challenge packet is built with these characteristic:

01: challenge packet type identifier

ID = sequential number that identifier the challenge

Random = a reasonably random number generated by the Router 3640-1 = the authentication name of the challenge

The ID and random values are kept on the called router

The challenge packet is sent to the calling router. A list outstandingchallenges is maintained


74/101



Response The ID value is fed into the MD5 hash generator

The random value is fed into the MD5 hash generator

The name 3640-1 is used to lookup the password. The Router looks for an

entry that matches the username in the challenge . In this example, it looksfor:

username 3460-1 password pc1

The password is fed into the MD5 hash generator

This result is the one-way MD5-hashed CHAP challenge that is sent backin the CHAP response


75/101



Response (continued) The response packet is assembled from these components:

02 = CHAP response packet type identifier

ID = copied from the challenge packet

Hash = the output from the MD5 hash generator (the hashedinformation from the challenge packet)

766-1 = the authentication name of this device. This is needed for thepeer to look up the username and password entry needed to verifyidentify

The response packet is then sent to the challenger


76/101



Verify CHAP The ID is used to find the original challenge packet The ID is fed into the MD5 hash generator

The original challenge random value is fed into the MD5 hash generator

The name 766-1 is used to look up the password from one of thesesources:

Local username and passoword database

RADIUS or TACACS+ server

The password is fed into the MD5 hash generator

The hash value received in the response packet is then compared with thecalculated MD5 hash value. CHAP authentication succeds if the calculatedand the received hash values are equal
http://www.bkacad.com/http://www.bkacad.com/http://www.bkacad.com/


77/101



Result If authentication is successful, a CHAP success packet is built from these

components:

03 = CHAP success message type ID = copied from the response packet

Welcome in is simply a text message that provides a user-readableexplanation

If authentication fails, a CHAP failure packet is built from thesecomponents:

04 = CHAP failure message type

ID = copied from the response packet

Authentication failure or other text message , that provider a user-readable explanation

The success or failure packet is then sent to the calling router


78/101


79/101



80/101


Notes:

- sent-username and password must match remote username and password.

- Passwords are case-sensitive, but usernames are not.

- Hostnames are not involved.

Example: Configuring PAP

172.25.3.0/24Serial .1/S0.2/S0

DCEDTE

hostname SantaCruz

username HQpassword HQpass

interface Serial0

ip address 172.25.3.2 255.255.255.0

encapsulation ppp

ppp authentication pap

ppp pap sent-username SantaCruz

password SantaCruzpass

hostname HQ

username SantaCruzpassword SantaCruzpass

interface Serial0

ip address 172.25.3.1 255.255.255.0

encapsulation ppp


ppp pap sent-username HQ

password HQpass

O


81/101


Extra: One-way PAP authentication

(config)# hostname RA

(config)# interface serial 0

encapsulation ppp

ppp pap sent-username RA-X password

CISCO-X(config)# hostname RB

(config)# username RA-X passwordCISCO-X


encapsulation ppp

E T PAP h i i


82/101


Extra: Two-way PAP authentication


(config)# username RB-X password CISCO-B


encapsulation ppp


ppp pap sent-username RA-X password CISCO-A

(config)# hostname RB

(config)# username RA-X password CISCO-A(config)# interface serial 0

encapsulation ppp


ppp pap sent-username RB-X password CISCO-B

E l C fi i CHAP


83/101


Notes:

- Hostnames are involved unless theppp chap hostname command is used, and must

match remote routers username command (not case-sensitive).

- Passwords are case-sensitive and must match

Example: Configuring CHAP

172.25.3.0/24Serial .1/S0.2/S0

DCEDTE

hostname SantaCruz

username HQpasswordboardwalk

ppp chap hostname SantaCruz (optional)

interface Serial0

ip address 172.25.3.2 255.255.255.0

encapsulation ppp

ppp authentication chap

hostname HQ

username SantaCruzpasswordboardwalk

ppp chap hostname HQ (optional)

interface Serial0

ip address 172.25.3.1 255.255.255.0

encapsulation ppp

ppp authentication chap

E t O CHAP th ti ti


84/101


Extra: One-way CHAP authentication

(config)# hostname RA-X

(config)# username RB password CISCO


encapsulation ppp

OR



encapsulation ppp

ppp chap hostname RA-X

(config)# hostname RB

(config)# username RA-X password C



85/101


Troubleshooting a PPP Configuration with Authentication

In the last line, the code = 4 means a failure has occurred. Other code values are asfollows: 1 = Challenge 2 = Response 3 = Success 4 = Failure

E t C fi i PPP M ltili k (MLP)


86/101


Extra: Configuring PPP Multilink (MLP)

Router(config)#interface serial 0/0Router(config-if)#encapsulation ppp

Router(config-if)#ppp multilink

In some environments, it may be necessary to bundle multiple serial linksto act as single link with aggregated bandwidth.

Multilink PPP provides load balancing over the router interfaces that PPPuses.

E t C fi i PPP M ltili k


87/101


Extra: Configuring PPP Multilink

hostname SantaCruz

multilink Virtual-Template 1

interface loopback 0

ip address 192.168.1.1 255.255.255.0

interface Virtual-Template1

ip unnumbered loopback0

ppp multilink

interface Serial0

no ip address

encapsulation ppp

ppp multilink

interface Serial1

hostname HQ

multilink Virtual-Template 1

interface loopback 0

ip address 192.168.1.2 255.255.255.0

interface Virtual-Template1

ip unnumbered loopback0

ppp multilink

interface Serial0

no ip address

encapsulation ppp

ppp multilink

interface Serial1

E t C fi i PPP M ltili k


88/101


Extra: Configuring PPP Multilink

(config)# interface Multilink 1

ip address 1.2.3.4 255.255.255.0

ppp multilink

(config)# interface Serial 0/0

no ip address

encapsulation ppp

ppp multilink

multilink rou 1

PPP A th ti ti


89/101


PPP Authentication


90/101


Using Frame-relay

Overview of Frame relay


91/101


Overview of Frame-relay

Frame Relay is a nonbroadcast

multi-access network (NBMA).

Frame relay functionality


92/101


Frame-relay functionality

In Frame Relay, this address is the data-link connectionidentifier (DLCI). The DLCI identifies the VC that data uses to reach a

particular destination.

The DLCI usually has only local significance and may bedifferent at each end of a VC.

The Layer 2 DLCI is associated with the Layer 3 addressof the device at the other end of the VC.

Mapping the DLCI to a remote IP address can occur

manually or dynamically using a process known asInverse ARP.



93/101



Establishing a mapping of DLCI to remote IP address occurs in thefollowing steps:

1. The local device announces its presence by sending its Layer 3address out on the VC.

2. The remote device receives this information and maps the Layer3 IP address to the local Layer 2 DLCI.

3. The remote device announces its IP address on the VC.

4. The local device maps the Layer 3 address of the remote device

to the local DLCI on which it received the information.



94/101



Local Management Interface (LMI) is a signaling standard between the DTEand the Frame Relay switch.

LMI is responsible for managing the connection and maintaining thestatus between devices.

LMI messages provide communication and synchronization betweenthe network and the user device.

LMI provides VC connection status information that appears in theFrame Relay map table:

Active State

The connection is active and routers can exchange data.

Inactive State

The local connection to the FR switch is working but the remoteconnection to the FR switch is not.

Deleted State

The local connection receives no LMI messages from the FR switch orthere is no service between the CPE router and the FR switch.



95/101





96/101



The CIR is the minimum bandwidth rate guaranteed by the provider for dataon a VC.

The service provider calculates the CIR as the average amount of datatransmitted over a period of time.

The calculated time interval is the committed time (Tc). The number of committed bits within the Tc is the committed burst (Bc).

The cost of the Frame Relay service depends on the speed of the link and theCIR. The CIR defines the minimum rate provided; however, if there is no

congestion on the links, the service provider boosts or bursts thebandwidth up to a second agreed-upon bandwidth.

The excess information rate (EIR) is the average rate above the CIR that a VC

can support when no network congestion exists. Any extra bits above the committed burst, up to the maximum speed of the

access link, is known as the excess burst (Be).


97/101



98/101

Hc vi

n cng ngh

thng tin Bach Khoa - Website: www.bkacad.com


The forward explicit congestion notification (FECN) is a single-bit field that canbe set to a value of 1 by a switch. It indicates to an end DTE device that thenetwork is congested ahead.

The backward explicit congestion notification (BECN) is a single-bit field that,when set to a value of 1 by a switch, indicates that the network is congested inthe opposite direction.



99/101

Hc vi

n cng ngh



Summary


100/101

Hc vi

n cng ngh


Summary

WAN technologies WAN devices VC: PVC, SVC

HDLC PPP: Operation, Configuration. Frame-relay


101/101

ccna dis3 - chapter 7 - implementing enterprise wan links_ppt [compatibility mode]

Documents