Academia.eduAcademia.edu

CCNA

CCNA Routing and Switching

IP Services DH CP • Dynamic Host Configuration Protocol – Used to automate end host’s IP configuration • DHCP uses “options” to assign… – IP address – Subnet mask – Default gateway – DNS server 1 H ow DH CP Work s • DHCP is an extension of the Bootstrap Protocol (BOOTP) • Four messages – DHCP Discover • Client tries to find the DHCP server(s) – DHCP Offer • Server proposes an assignment to client – DHCP Request • Client tells the server it wants the address – DHCP Acknowledgement • Server finalizes address assignment DH CP T ra nsport • BOOTP uses UDP broadcast packets – Source port BOOTPC 68 – Destination port BOOTPS 67 • Broadcasts aren’t forwarded between subnets – Implies your server must be in the same broadcast domain as the client – Alternative to this is DHCP Relay • Broadcast to Unicast BOOTP conversion 2 Cisc o I OS a nd DH CP • IOS supports the following – DHCP server – DHCP client – DHCP proxy • E.g. translate IPCP request into DHCP – DHCP relaying • Server configured using DHCP pools – Each pool has an IP subnet for allocation – Host pools are supported DH CP Pool Se le c t ion • Server may have multiple address pools • Pool is selected based on… – DHCP Client ID (could be any string) • Supplied by Windows clients but not Linux – DHCP Hardware Address if ID is missing – Relaying gateway IP address – Receiving interface IP subnet if no matching pool found and no relay IP address present 3 DH CP Re la ying • Broadcast can be relayed to unicast destination – ip helper-address <IP> interface command • In case of DHCP, relaying router inserts interface IP address – Known as “giaddr” or gateway address – Other options could be inserted, e.g. Information Option • DHCP server matches pool based on giaddr DN S • Domain Name System (DNS) – Hierarchical naming system for end hosts in IP networks – Resolves IPv4/IPv6 addresses to names • E.g. www.cisco.com to IP address 1.2.3.4 • Originally implemented as Berkeley Internet Name Domain (BIND) Server – ~70% of Internet DNS servers run BIND – Actual implementation out of our scope, see book “DNS and BIND” for more information 4 Cisc o I OS a nd DN S • IOS has DNS client enabled by default – Configure servers with ip name-server <IP> – Broadcast if no server configured – no ip domain-lookup to disable • IOS can be configured as DNS server – ip dns server to enable – ip host <NAME> <IP> for local DNS entries – ip name-server <IP> to relay requests N AT • Network Address Translation • Used to rewrite IP addresses in layer 3 IP packets – Normally to hide private IP addresses from Internet – Can also resolve overlapping subnet issues • Destination IP rewrite may be used for redirection – Normally configured as static mapping • Port Address Translation – Many to one translation based on TCP/UDP port – Common for overloading scenarios 5 N AT T e rm inology • Inside zone - networks that translator wants to hide – Inside local - Inside IPs before translation – Inside global - Inside IPs after translation • Outside zone - networks that are external to translator – Outside global - Original outside IP address – Outside local - Outside IP after translation as it seen inside ACLs • Access Control Lists – Used to limit access to network resources • IP packets are checked against ACL entries before being forwarded – Check starts from top of list and works down – Packets that match first defined criteria can be • Permitted (forwarded) • Denied (dropped) – Unmatched packets are dropped by default • Called “implicit deny” 6 St a nda rd vs. Ex t e nde d ACLs • Standard Access-Lists match on… – Source IP address • Extended Access-Lists match on… – IP protocol number – Source address/Destination address – Protocol options • TCP / UDP ports e ( q, neq, lt, gt, range) • ICMP Type Code • TCP state e ( stablished keyword) – Packet markings (DSCP/IPP) – Non-initial fragments (fragments keyword) Ac c e ss List Logging • Log message can be generated on ACL match – log vs. log-input – Generated as syslog level “informational” – Causes packets to be process switched • ACL Logging rate-limiting – ip access-list logging interval – ip access-list log-update threshold – logging rate-limit 7 Com m on ACL Applic a t ions • Traffic Filtering – ip access-group • Traffic Classification – match access-group • Route Filtering – distribute-list or route-map • VTY line/username access-control – access-class in/out 8