Alternative Traffic Sources: Diversity and Conversion

Traffic Sniper AI Traffic App

More Information

My Traffic Sniper AI Traffic App Review

Traffic Sniper AI Traffic App offers lots of key features that the power users are usually interested in, wrapped up in a friendly and likable interface, at the same time benefiting from great online support & tutorials, which makes Traffic Sniper AI Traffic App an easy to use program even for the inexperienced users.

This is an amazing piece of software at a bargain price, you can not lose. If you have any information about the cons of this software, please share with us.

All Internet traffic from all sites goes across the central site

Internet Traffic Flow in an MPLS VPN Backbone Internet traffic flow becomes a more serious issue in combined VPN and Internet backbones. The traffic flow issue becomes even more pronounced when the customer VPN (based on, for example, MPLS VPN services) and the Internet traffic share the same service provider backbone. In this case, the traffic from a customer site may have to traverse the service provider backbone as VPN traffic, and then return into the same backbone by the corporate firewall, ending up at a server very close to the original site. The link between the central site and the provider backbone has to be over-dimensioned, because it has to transport all of the customer Internet traffic. The provider backbone is overutilized, because the same traffic crosses the backbone twice, first as VPN traffic and then as Internet traffic (or vice versa).

Miscellaneous sysopt Commands

The PIX in this scenario is set up with a nat (inside) 0 0 0 command, which implies that PIX will not translate any of the IP addresses on the inside network. Due to how the nat 0 command is designed, the PIX starts to proxy ARP on the outside interface for any and all addresses upon being configured in this manner. Consequently, if host A wants to access the Internet and sends an ARP and the PIX proxy ARPs before the router can respond, host A would be sending traffic destined for the Internet to the PIX, which is incorrect routing. The way around this scenario is to turn off proxy ARP on the PIX. However, after you do this, the PIX stops ARPing for all addresses, even the ones for which it should ARP. Now the router needs to be set up with routes for the inside network behind the PIX so that it does not have to rely on the PIX proxy ARPing for that network.

Configuring IEEE 8023X Flow Control on Gigabit Ethernet Ports

Flow control is supported only on 10 100 1000 ports and GBIC-module ports. Flow control enables connected Gigabit Ethernet ports to control traffic rates during congestion by allowing congested nodes to pause link operation at the other end. If one port experiences congestion and cannot receive any more traffic, it notifies the other port to stop sending until the condition clears. When the local device detects any congestion at its end, it can notify the link partner or the remote device by sending a pause frame. Upon receipt of a pause frame, the remote device stops sending any data packets, which prevents any loss of data packets during the congestion period.

Search Engine Traffic Guide

Best Affiliate Marketing Resources

Instant Linkbuilding Solutions

Configuring Firewall Policies

In the second scenario, you might prefer to enforce a centralized firewall policy for personal firewalls on VPN client PCs. A common example would be to block Internet traffic to remote PCs in a group using split tunneling. This approach protects the PCs, and therefore the central site, from intrusions from the Internet while tunnels are established. This firewall scenario is called push policy or Central Protection Policy (CPP). On the security appliance, you create a set of traffic management rules to enforce on the VPN client, associate those rules with a filter, and designate that filter as the firewall policy. The security appliance pushes this policy down to the VPN client. The VPN client then in turn passes the policy to the local firewall, which enforces it.

Implementing a Cisco IOS Zone Based Firewall

This results in two flows (192.168.1.0 24 to any, 192.168.2.0 24 to any), and we can apply different inspection parameters to these flows to configure the different behaviors. Zone-based policy firewalls allow inside-to-Internet traffic (the source zone inside and the destination zone outside).

Root Bridge Configuration

As the common reference point, the Root Bridge (and the secondary) should be placed near the center of the Layer 2 network. For example, a switch in the distribution layer would make a better Root Bridge choice than one in the access layer because more traffic is expected to pass through the distribution-layer devices. In a flat switched network (no Layer 3 devices), a switch near a server farm would be a more efficient Root Bridge than switches elsewhere. Most traffic will be destined to and from the server farm and will benefit from a predetermined, direct path.

Cisco Systems Terms and Acronyms

Method of distributing Web traffic by taking into account Web server availability and relative client-to-server topological distances in order to determine the optimal Web server for a client. DistributedDirector uses the Director Response Protocol to query DRP server agents for BGP and

Signature Definition File SDF

An IPS loads the signatures contained in the SDF and scans incoming traffic for matching signatures. In the network topology shown in the figure, the branch offices are the best places to enable Cisco IOS IPS on both directions of the Internet-facing interface. A common scenario is when split tunneling is enabled while running VPN tunnels to the corporate network. Cisco recommends enabling Cisco IOS IPS on the Internet traffic to protect the network from attacks and exploits that might come into the branch office or telecommuter personal computers, which could in turn affect the corporate network.

Disables access to minor TCP services such as echo

Allow Internet traffic for ftp and ftp-data only from network 144.254.0.0 access-list 109 permit tcp 144.254.0.0 0.0.255.255 host 192.150.50.8 0.0.0.0 eq ftp allow Internet traffic for smtp and www server to specific servers access-list 109 permit tcp any host 192.150.50.9 0.0.0.0 eq http

Tools for Analyzing Traffic

Tools used for traffic analysis range from manual identification of applications using Cisco IOS software commands to those in which dedicated software- or hardware-based analyzers capture live packets or use the Simple Network Management Protocol (SNMP) to gather interface information. Analysis tools include the following Remote monitoring probes can also be used to support traffic analysis. The following sections include examples of some of these tools.

Modular Network Design

A core block is required to connect two or more switch blocks in a campus network. Because all traffic passing to and from all switch blocks, server farm blocks, and the enterprise edge block must cross the core block, the core must be as efficient and resilient as possible. The core is the campus network's basic foundation and carries much more traffic than any other block.

Cnse Study Injecting IGP Routes into BGP

Chapter 2 emphasizes that at an AS border, outgoing route advertisements affect incoming traffic, and incoming route advertisements affect outgoing traffic. As a result, outgoing and incoming advertisements should be considered separately. This section begins the discussion of BGP route advertisements by examining basic methods of injecting routes into BGP.

Email Marketing Master Course

Create Your First Money Making Website

Profitable Online Blogging

Standard IP Access Lists

Example 7-3 denies all traffic that should be denied based on the criteria however, it denies more traffic than the first of the three criteria says it should In many cases, the meaning of the criteria for the access lists greatly affects your configuration choices. For example, Example 7-3 solved some of the problems of Example 7-2 by filtering packets from 10.1.2.1 (Sam) and preventing them from exiting both of Yosemite's serial interfaces, keeping Sam from getting to Albuquerque. However, that also prevents Sam from communicating with anyone outside Yosemite. An alternative would be to use the same access-list 3 logic, but use it as an inbound access-list on Albuquerque's serial interfaces.

Generic Traffic Shaping Configuration

The only feature of GTS not already covered to some depth, other than configuration, is the concept of shaping a subset of the traffic on an interface or subinterface. GTS can classify traffic with an ACL traffic permitted by the ACL is shaped based on the parameters specified on the same command. For instance, you could shape all FTP traffic to 32 kbps, and web traffic to 64 kbps.

Internet Extranet and MPLS Security

This necessitates stringent adherence to service provider security best practices to ensure the security and reliability of the backbone. In addition, you must address network design issues to guarantee that corporate (once private network) data is not adversely impacted by the vagaries of the Internet data flows. Of course, high volumes of corporate data (for instance, large image transfers or data backups) could also impact the infrastructure to an extent that Internet traffic suffers. However, Internet traffic is typically viewed as best effort traffic with little or no expected service levels, and as such, as long as user performance is not unduly hindered, this should not be a major issue. As the usage profiles of the Internet change to support traffic that has more stringent latency or jitter restrictions, more attention might be required with respect to general traffic performance.

HELLO Welcome to httpwwwwormcom Hacked By Chinese

A hacker can select port 443 as a listening port and remain undetected. The hacker can then set up a port redirector without disrupting operations. A port redirector takes traffic coming in on one port and directs it to another host on another port. In this example, the port redirector on the web server takes incoming traffic on port 443 and sends it out to port 3389 on the database server.

Class Based Tunnel Selection

You can directly apply the CBTS feature on TE tunnels with a PE router as the head end router and the incoming traffic from a virtual routing forwarding (VRF) interface. You can map each EXP bits value to a particular TE tunnel. Three bits for the EXP bits give you eight levels of QoS, so you can even use eight TE tunnels between a pair of LSRs and map each EXP bits value to a different TE tunnel. The command to assign CBTS to a TE tunnel is as follows

Load Balancing in CEF

Per-packet load sharing, however, gives a perfect load sharing distribution on the outgoing paths, whereas the per-destination load sharing is only a statistical method of distributing flows per pairs of (source IP address, destination IP address). Therefore, the load sharing of traffic with the perdestination method can only give a good result (a good distribution among all possible outgoing links) if enough different pairs of source and destination addresses make up the traffic toward the different destinations that are outbound on the outgoing links. Even then, if some flows are present, with considerably more traffic on than some others, which are on one path, the distribution might still be uneven. Look at Example 6-6 to see how to change the CEF load balancing scheme.

Example 632 Using Traffic Policing to Regulate Traffic

The next example, Example 6-34, shows how a two-bucket traffic policy sets the ToS bits for differ traffic type and burst size. Example 6-34 shows how class Servers sets the traffic policy for all trafl network 209.145.63 2 Class apps specifies all traffic using the Telnet, SMTP protocols, or passi 209.145.63.8n and class web specifies HTTP web traffic. In the example traffic belonging to the Ser conforms to the average bit rate of 4 Mbps with a 750,000-byte normal burst and 1,500,000-byte, have its DSCP valu e cluanged to cs2. Traffic exceeding the normal burst will have its DSCP value ch any Seovers traffic that violates the excess burst rate will be transmitted without a DSCP value cha specifies that traffic going to the servers on the 209.145.63.0 27 network will have a 3-Mbps avera 562,500-byte normal burst, and a 1,125,000-byte extended burst.

Characterizing the Existing Network and Sites

Step 3 Traffic analysis If possible, use traffic analysis to provide information about the applications and protocols used and to reveal any shortcomings in the network. NOTE Although traffic analysis is a good idea in principle, it is often too costly in terms of time and effort to do in practice.

Tail Drop Global Synchronization and TCP Starvation

Tail drop occurs when a packet needs to be added to a queue, but the queue is full. Yes, tail drop is indeed that simple. However, tail drop results in some interesting behavior in real networks, particularly when most traffic is TCP based, but with some UDP traffic. Of course, the Internet today delivers mostly TCP traffic, because web traffic uses HTTP, and HTTP uses TCP.

Case Study 101 Answers

With a suitable PIX Security appliance model, VLANs can be trunked to the core switches. VLANs can then be used to separate the public zone (for public servers) and the E-commerce zone (the DMZ). The firewall also secures outbound Internet traffic from ACMC (providing Internet access for the main campus). 3. To secure the remote clinics, the Cisco IOS Firewall and Cisco IOS IPS features in the ISRs should be used. IPsec VPN acceleration can be used for high-performance secure connectivity on the backup links across the Internet. VPN split tunneling is used so that the remote Internet traffic does not have to go across an IPsec tunnel and then back out to the Internet from the main campus. Using NAC and Cisco Security Agents should be considered to increase security. URL filtering could improve security for remote users.

Policing When and Where

Whenever the physical clock rate exceeds the traffic contract, policing may be needed. Suppose, for instance, that ISP1 has 1000 customers, just like PB Tents, each with a 100-Mbps connection, and a contract for support of 2 Mbps. What happens over time Well, without something to prevent it, each customer will send and receive more and more traffic. For a while, all the customers are happy, because their packets make it through the overbuilt ISP1 core. Even if ISP1 has enough capacity to support 10 Mbps of traffic from every customer, eventually, ISP1's network will become overrun, because their customers keep sending more and more traffic, so eventually all traffic will suffer. Queues become congested frequently, causing dropped packets. Multimedia traffic suffers through the poor performance as a result of high delay and jitter. TCP sessions continually decrease their window sizes because of the lost packets, causing synchronization effects inside ISP1.

Scaling the Network with NAT and PAT

Two Internet scalability challenges are the depletion of registered IP version 4 (IPv4) address space and scaling in routing. Cisco IOS Network Address Translation (NAT) and Port Address Translation (PAT) are mechanisms for conserving registered IPv4 addresses in large networks and simplifying IPv4 address management tasks. NAT and PAT translate IPv4 addresses within private internal networks to legal IPv4 addresses for transport over public external networks, such as the Internet, without requiring a registered subnet address. Incoming traffic is translated back for delivery within the inside network.

How to Make Money on Social Media

Grow Your Twitter Followers

Automatic Content Generation with Article Spinner

Single Homed Autonomous System

An important principle to remember when working with inter-AS traffic is that each physical link actually represents two logical links one for incoming traffic and one for outgoing traffic (see Figure 2-11). The routes you advertise in each direction influence the traffic separately. Avi Freedman, who has written many excellent articles on ISP issues, calls a route advertisement a promise to carry packets to the address space represented in the route. In Figure 2-10, the subscriber's router is advertising a default route into the local AS a promise to deliver packets to any destination for which there is not a more-specific route. And the ISP's router, advertising a route to 205.110.32.0 20, is promising to deliver traffic to the subscriber's AS. The outgoing traffic from the subscriber's AS is the result of the default route, and the incoming traffic to the subscriber's AS is the result of the route advertised by the ISP's router.

Assured Forwarding Versus Expedited Forwarding

Consider the fact that the EF iHB's main purpose is to provide a forwarding behavior that introduces as little delay and jitter as possible. If more traffic is received for transmission than an interface can transmit, a queue begins to form. When a device queues traffic, by definition it introduces delay. As such, it can be inferred that building a queue is undesirable when implementing the EF iHB.

Link State Versus Distance Vector Routing Protocols

I occasionally invoke a rule I invented that I call the It Depends Rule, and I am invoking it now OSPF is usually more efficient than RIP in exchanging routing information when a network is stable however, for this rule to hold true, it depends on network events. For example, during an external convergence event, OSPF could flood more traffic than RIP. Consider that RIP carries 25 routes per update on the other hand, OSPF floods a single LSA per external route that is affected by the convergence event. So, provided that you have a (relatively) stable environment, OSPF involves less traffic, and over time, it is statistically more economical than RIP. Using a single LSA per external route is inefficient, but OSPF was never designed to be an EGP. Therefore, I recommend an OSPF BGP deployment when large numbers of external routers are present.

Packet Sniffer Mitigation

Antisniffer tools Employing software and hardware designed to detect the use of sniffers on a network. Such software and hardware does not completely eliminate the threat, but like many network security tools, they are part of the overall system. These so-called antisniffers detect changes in the response time of hosts to determine if the hosts are processing more traffic than their own. One such network security software tool, which is available from Security Software Technologies, is called AntiSniff.

RED and IP Precedence Weighted RED

Above the minimum threshold and heading up to the maximum threshold Some number of packets are dropped. This depends on the average queue depth at die time and the value of the mark probability denominator. When the denominator specifies an aggressive drop policy, packets are dropped more frequently. As the average queue depth climbs, so does the frequency of drops up to the value of the denominator itself. The drops throttle-back TCP flows to control queue depth (as more packets get dropped, more traffic should be throttled-back).

Advertising Aggregate and Selected More Specifics

The previous scenarios send the more-specific routes of AS 100 to AS 200 so that AS 200 can implement routing policy. That is, AS 200 uses the routes to set routing preferences for sending traffic to AS 100. AS 100 also can influence its incoming traffic by manipulating its outgoing advertisements. For example, advertising 192.168.193.0 24 over the Stowe Sugarbush link and not over the Mammoth Diamond link causes incoming traffic to use the Stowe Sugarbush link. An administrator might want to implement such a policy if the AS is geographically diverse. For instance, Stowe might be in Vermont and Mammoth in California. The administrator might want incoming traffic to use the ingress point closest to the destination, to minimize internal routing. An aggregate route is advertised over both links for backup so that if either link fails, all incoming traffic is routed to the remaining link.

Vulnerabilities Attacks and Common Exploits

DoS attacks are designed to send traffic to host systems so that they cannot respond to legitimate traffic by overwhelming the end device through a number of incomplete and illegal connections or requests. DoS attacks send more traffic than is possible to process and can send excessive mail requests, excessive UDP packets, and excessive Internet Control Message Protocol (ICMP) pings with very large data packet sizes to render a remote host unusable.

Unequal Cost Load Sharing

Assume that unequal-cost paths are calculated based on path cost, with the amount of traffic forwarded down a particular path being inversely proportional to the cost of the path the lower the path cost, the more traffic is forwarded down that path. no more traffic is left. If the load-share value is configured, it is used as the ratio with which to share. Otherwise, you share traffic between multiple parallel tunnels in accordance with the configured bandwidth. Traffic share is directly proportional to bandwidth the more bandwidth a tunnel has, the more traffic it receives. The load-share value works the same way. It's just a knob that lets you reserve the same bandwidth on multiple tunnels but share differently between them. For the following discussions, bandwidth refers to tunnel bandwidth or load-share value.

Attaching a Cisco IP Phone

Configures the interface to classify incoming traffic packets according to the class of service (CoS) value. For untagged packets, the default CoS value is used. The default port CoS value is 0. Configures the interface to classify incoming traffic packets according to the differentiated services code point (DSCP) value. For a non-IP packet, the packet CoS value is used if the packet is tagged. For an untagged packet, the default port CoS value is used.

Class Based Shaping Configuration

CB shaping can be configured to work just like GTS, but it has an option with which you can tell it to send even more traffic during each interval. To work just like GTS, you would configure CB shaping using the shape average command, with which you configure the shaping rate, and optionally the Bc and Be values, in bits. CB shaping sends Bc bits per Tc, or Bc + Be bits after periods of low activity, just like GTS.

Configuration Exercises

3 Networks 192.168.1.0, 192.168.2.0, 192.168.3.0, 192.168.4.0, and 192.168.5.0 exisi within AS 2. The administrator of this AS wants the neighboring AS to prefer R5 when sending traffic to 192.168.1.0 and 192.168.3.0. The neighboring AS should prefer R6 when sending traffic to 192.168.2.0 and 192.168.4.0. In each case, the less-preferred link serves as a backup to the more-preferred link. 192.168.5.0 is a private network and must not be advertised to any EBGP peer. Modify the configurations written in Exercise 2 to implement this policy.

Inline Deep Packet Inspection

By definition, IDS and IPS solutions incorporate signatures that trigger based on information that is located throughout the packet. Inline deep-packet inspection refers to the ability to perform actual protocol analysis on network traffic. Many applications (including malicious programs) attempt to use open ports to pass information through access control lists on your network. Using inline deeppacket inspection enables you to enforce your security policy beyond basic port numbers. For instance, this functionality enables you to prevent attackers (and applications) from sending traffic to or from port 80 unless the traffic is legitimate HTTP traffic.

Port Scan and Ping Sweep Mitigation

Network-based IPS and host-based IPS (HIPS) can usually notify you when a reconnaissance attack is under way. This warning allows you to better prepare for the coming attack or to notify the Internet service provider (ISP) that is hosting the system launching the reconnaissance probe. ISPs compare incoming traffic to the intrusion detection system (IDS) or the IPS signatures in their database. Signatures are characteristics of particular traffic patterns. A signature, such as several packets to different destination ports from the same source address within a short period of time, can be used to detect port scans. Another such signature could be SYN to a non-listening port.

Figure 814 Example of Mpls Vpn QoS Hose Model

A service provider can offer a VPN customer the pipe model, hose model, or a combination of both. The PE routers at the ingress determine which traffic receives a particular CoS, depending on the incoming interface, IP source and destination addresses, IP precedence, TCP port numbers, or a combination of these values. The ingress PE routers can also police incoming traffic and mark packets that are out-of-rate, based on the SLA drawn with the customer. These packets can be marked differently and dropped in case of congestion.

Standard IP Access List Configuration

The configuration in Example 8-5 solves the problem of the earlier example, but it creates another problem. Example 8-5 denies all traffic that should be denied, but it also denies more traffic than the first of the three criteria says it should In many cases, the meaning of the criteria for the access lists greatly affects your configuration choices. In this example, the problem of Sam's traffic going through Seville to reach Albuquerque when the link directly to Albuquerque is down is solved. The access list denies traffic from Sam (10.1.2.1) in an outbound access list on both of Yosemite's serial interfaces. However, that also prevents Sam from communicating with anyone outside Yosemite. This does not meet the spirit of the filtering goals, because it filters more than it should. An alternative would be to use the same access-list 3 logic but use it as an inbound access list on Albuquerque's serial interfaces.

The Integrated Services QoS Model

Another problem with IntServ in large networks and in the Internet relates to the fact the RSVP reserves bandwidth per flow. With DiffServ, for instance, all web traffic might be marked with DSCP AF21 and placed into a single class even if there are hundreds, thousands, or tens of thousands of flows. With IntServ, each flow causes a separate reservation. In fact, DiffServ created an Internet-scale QoS model in part because the earlier IntServ specification did not scale well for the Internet, even if you could get most or all ISPs to implement IntServ and RSVP. key video-conferencing stations may be useful. Allowing voice gateways to request reservations for VoIP calls can also help. The DiffServ model can be used to place all VoIP into a class, and give the class better treatment, but IntServ can guarantee the QoS behavior and reject new calls if the network is currently not ready to accept more traffic.

NAT and Multihomed Autonomous Systems

Another shortcoming of CIDR is that multihoming to different service providers becomes more difficult. Figure 4-5 recaps the problem as discussed in Chapter 2. A subscriber is multihomed to ISP1 and ISP2 and has a CIDR block that is a subset of ISPl's block. To establish correct communication with the Internet, both ISP1 and ISP2 must advertise the subscriber's specific address space of 205.113.50.0 23. If ISP2 does not advertise this address, all the subscriber's incoming traffic passes through ISP1. And if ISP2 advertises 205.113.50.0 23, whereas ISP1 advertises only its own CIDR block, all the subscriber's incoming traffic matches the more-specific route and passes through ISP2. This poses several problems

Primary Backup Link Selection

Controlling the load distribution of incoming traffic over multiple links is more difficult in the multihomed scenario when links to multiple service providers are used. You cannot use the multi-exit discriminator (MED) when the customer connects to multiple providers because the updates are sent to two different autonomous systems. Recall that the MED is used only when you compare routes that are received from a single directly connected AS over two parallel links. Therefore, route selection decisions will most likely use the AS-path attribute and prefer the route with the shortest AS-path length.

Using Dynamic ARP Inspection

Attackers can attempt to launch an attack by sending gratuitous ARP (GARP) replies. These GARP messages can tell network devices that the attacker's MAC address corresponds to specific IP addresses. For example, the attacker might be able to convince a PC that the attacker's MAC address is the MAC address of the PC's default gateway. As a result, the PC starts sending traffic to the attacker. The attacker captures the traffic and then forwards the traffic to the appropriate default gateway.

Diff Serv Classifiers and Traffic Conditioners

AF2x Web Traffic from E-Commerce Servers AF3x VoIP Signaling AF4x VoIP Payload AF2x Web Traffic from E-Commerce Servers AF3x VoIP Signaling AF4x VoIP Payload DiffServ defines traffic conditioning as the second important function at the boundary node. Traffic conditioning defines what to do to prevent traffic from exceeding contracts, but if it does, what to do with traffic that exceeds the contract. If McCoy always only sends what the contract defines, great If McCoy breaks that trust and sends more traffic, and ISP1 does not monitor the traffic and possibly deletes the extra traffic, however, bad things can happen to all of ISP1's customers. It's like making a reservation on a plane. You know some people will change their flights, and some will miss their flights, but the airline will generally not give you a reservation unless there is a seat on the plane.

Three Interface Configuration with DMZ

ACL 112 permits internet traffic inspected by the firewall destined to the DMZ. ACL 121 corresponds to acl 112. it allows internet traffic inspected by the firewall to the server on the DMZ. ACL 121 is applied to inbound traffic on the outside interface (s0 0). ACL 121 corresponds to acl 112, it allows internet traffic inspected by the firewall to the server on the DMZ.

Calling the Access List

In Figure B.10, the TCP, UDP, and ICMP access lists given earlier as examples are used as filters. Access list 110, from the previous two examples, has been applied to the Token Ring 0 interface to check incoming traffic. Access list 111 is applied to the same interface to check outgoing traffic. Analyze the two access lists carefully, including their interrelationship, and consider the following

ISIS and Default Routes

The default-information originate command is used with level 2 routers for sending traffic to destinations not found in the local routing table. This command is used to send a default route in the backbone, and it creates an external entry into the L2 LSP. Unlike OSPF, this command does not require a default route to be present in the router that is originating the default route.

Proper Return Path Selection

Remember that the incoming traffic flow (from the perspective of AS 213) will be a result of the route selection for outgoing traffic in AS 387. The traffic that is going out from AS 387 will end up as incoming traffic in AS 213. If AS 387 configures some changes that cause the route selection process for outgoing traffic to prefer to reach network 10.0.0.0 8 via AS 462, the changes would result in behavior matching the desired administrative policy for AS 213, which specifies that incoming traffic to the AS should be received over the high-speed link.

HTTP Inspection Engine

HTTP or web traffic is one of the most popular types of traffic on networks today. ASA includes the ability to inspect HTTP traffic flows to detect possible network attacks. You can initiate the process to configure the inspection of an HTTP traffic flow under the Service Policy Rules section. This process to initiate the creation of a traffic flow for HTTP inspection is similar to the process to define a traffic flow with Service Policy Rules for IPS inspection as described in the Intrusion Prevention Service section earlier in this chapter. The configuration to inspect a certain HTTP traffic flow results in a class-map and policymap statement, similar to the CLI output for the IPS Service Policy Rule configuration.

MPLS Traffic Engineering and Multicast

As you learned earlier, MPLS uses RSVP messages to build traffic engineering tunnels. In the point-to-multipoint case, you have multiple tail ends and a single head end for the traffic-engineered tunnel. To build a point-to-multipoint tunnel, the head end must send PATH messages to all the tail end nodes with the same tunnel ID. The PATH messages are received by the tail ends, and the tail end nodes respond with a RESV message. While the RESV message travels back toward the head end node, along the path, each core node performs admission control and merges the LSP upstream with the matching tunnel indicated by the tunnel ID. The merged reservation continues upstream toward the head end node, thus creating a multipoint tree from the head end to the tail ends. (See Figure 8-7.)

Source Trees vs Shared Trees

In multicast forwarding, the source is sending traffic to an arbitrary group of hosts that is represented by a multicast group address. The multicast router must determine which direction is the upstream direction (toward the source) and which one is the downstream direction (or directions). If there are multiple downstream paths, the router replicates the packet and forwards it down the appropriate downstream paths (best unicast route metric), which is not necessarily all paths.

Routers with Layer 34 Stateless ACLs

Because the ACL is stateless, the router has no idea whether a persistent SSH session is in place. This leads to the principal limitation of basic ACLs all a stateless ACL knows is to match incoming traffic against the ACLs applied to an interface. For example, even if there were no SSH session to 10.2.3.4 from network 10.1.1.0 24, host 10.2.3.4 could send traffic to the 10.1.1.0 24 network provided the source port is 22. The established flag on the ACL adds an additional requirement that the acknowledgment (ACK) or reset (RST) bit is set in the TCP header.

Selective Packet Discard

Managing congestion when it occurs is always tricky. What works in some instances may not work in others. Moreover, most congestion-management techniques have very little or no intelligence about one of the most ubiquitous forms of Internet traffic TCP data flows. Congestion-avoidance algorithms introduce this intelligence.

Privatization of the Internet

Although commercial traffic was encouraged on the regional level, any traffic passing over the NSFNET backbone had to comply with the Acceptable Usage Policy (AUP). This included all connectivity obtained through any of the Big Four. The aim of this policy was to encourage the development of a national commercial Internet infrastructure, and it succeeded, with companies such as UUNET, PSI, and ANS providing commercial Internet services. As mentioned previously, in 1991 the Commercial Internet exchange (CIX) was established for the exchange of Internet traffic among commercial providers.

Case Study Answers Case Study 3 Medi Bill Services

The only routed protocol necessary is IP because all of MediBill's applications, including PC network management, are IP-compliant. The client's only other type of traffic will be Internet traffic, which is also IP-based. Many companies are looking to simplify their network by standardizing to one protocol. You should use a protocol analyzer, such as Network Associate's Sniffer, which will demonstrate whether these packets are passing through the router or firewall to the other network. The Sniffer can also generate traffic such as pings to test an access list rule.

For More Information

The Differentiated Services IETF Working Group is defining relatively simple and coarse methods of providing differentiated classes of service for Internet traffic. Specifically, a small set of building blocks is defined that enables quality of service to be defined on a per-hop basis. This work is described in htt p www. ietf.org htm l.charte rs diffserv-ch a rter. html.

Split Tunneling Before and After

Split tunneling enables remote users to access Internet networks without requiring them to tunnel through the corporate network. Before split tunneling is enabled, all traffic originating from the Software Client is encrypted and routed through the secure tunnel. This traffic includes both secure and Internet browsing traffic. The secure traffic is terminated, while Internet traffic is routed back out to the Internet. A large percentage of the corporate backbone bandwidth is used for redirected web browsing traffic from remote users.

Technological Constraints

Recent technological developments are the reason that Internet traffic keeps increasing at a rapid pace. CPU processing speed takes approximately 18 months to double. The increase in Internet traffic and the inability of most organizations to augment capital equipment budgets to support these growth rates mean that CPU resources are a design constraint that you must address through network design and device configuration. Typically, the computation (processing) limitations that apply to network design are associated with processing routing-table calculations, encrypting and decrypting secured packets, accounting, enforcing access lists, or just forwarding packets.

The Service Provider Edge

One important difference between the tiers has to do with the relationship a provider has with other ISPs. Using an economic definition of peer (rather than the BGP definition), a peer relationship means that two ISPs do not charge each other to carry each other's traffic. They are both about the same size and it is to their mutual advantage to let their customers have access to each other, without worrying about billing. This differs from the other common ISP relationship, which is a customer-provider one, where a smaller ISP pays a larger ISP for the privilege of sending traffic through the larger ISP's network. This is often called buying transit.

IP Standard Access Lists

Note that the action taken if no more entries are found in the access list is to deny the packet this illustrates an important rule to remember when creating access lists. For example, consider what will happen if you create a list that simply denies traffic that you do not want to let into your network, and you configure this on an interface. If you forget about this rule, all of your traffic is denied the traffic explicitly denied by your list, and the rest of the traffic that is implicitly denied because the access list is applied to the interface.

Analyzing Network Traffic and Applications

Traffic analysis is the third step in characterizing a network. Traffic analysis verifies the set of applications and protocols used in the network and determines the applications' traffic patterns. It might reveal any additional applications or protocols running on the network. Each discovered application and protocol should be described in the following terms Figure 2-14 Use an Interactive Traffic Analysis Process Figure 2-14 Use an Interactive Traffic Analysis Process

Internet Access Through the Global Routing Table

An easy way to provide Internet access to CE routers is to have an interface from the PE to the CE router that is in the global routing space. The PE router has a VRF interface toward the CE router, but you can have a second interface that is not in a VRF toward the CE router. The routing on the CE router should then take care of sending the VPN traffic to the VRF interface and the Internet traffic to the interface in the global routing space on the PE router. The obvious disadvantage is that you need a second link between the PE and CE routers, using up an extra interface on both routers. To solve this, you can use subinterfaces when the Layer 2 encapsulation is Frame Relay or 802.1Q encapsulation. However, if the Layer 2 encapsulation does not allow subinterfaces, you can still use a workaround. A possible workaround might be sticking with just the VRF interface on the PE router and creating a GRE tunnel in the global routing space across that VRF interface.

Internet Access Through a Central VRF Site

Instead of traffic from each VPN site being forwarded directly to the Internet gateway router, it is possible to forward all the Internet traffic from the VRF sites to the CE router(s) of a central VRF site in a VPN. The advantage is that security features such as firewall services or other services such as Network Address Translation (NAT) are implemented only once and centrally in the central VRF site. The Internet traffic between the VRF sites and the VRF central site is then forwarded across the regular VRF interfaces in the normal manner for MPLS VPN. Look at Figure 7-31 for the network in this scenario. This is most likely the preferred scenario for hub-and-spoke VPN networks anyway. Note that at the central VRF site, you can deploy a firewall to verify all Internet traffic.

Stateful firewalls do not support user authentication of connections

As a defense against spoofing and DoS attacks Stateful packet filtering works on packets and connections. In particular, stateful firewalls track the state of the connection in the state table listing every connection or connectionless transaction. By determining whether packets belong to an existing connection or are from an unauthorized source, stateful firewalls only allow traffic from connections listed in the table. Once the firewall removes a connection from the state table, the firewall will not allow any more traffic from that device. In addition, the stateful firewall can log more information than a packet filtering firewall can, including when a connection was set up, how long it was up, and when it was torn down. This logging makes connections harder to spoof.

Traffic Shaping and Policing

Where does traffic shaping and traffic policing usually take place The CE devices can perform policing on the interfaces facing inside their site and enforce traffic rates. For instance, bulk traffic such as file-transfer over the WAN can be limited to a specific rate. Service providers usually perform policing on the edge device of their network on the interface receiving or sending traffic to the customer devices. Traffic shaping is often performed on the customer edge (CE) device, outbound on the interface sending traffic to remote sites over the provider backbone. If policing drops packets, certain flow types such as TCP-based flows will resend dropped traffic. Non-TCP traffic might resend a lot more traffic than just the dropped ones.

Identifying the Symptoms of Problems Occurring at the Physical Layer

A device might have a problem at the physical layer because more traffic is being directed to its interface(s) than it can serve. When troubleshooting this type of problem, you find that the interface under focus is operating at or near the maximum capacity and you might have an increase in the number of interface errors. When the physical layer problem is due to an actual breakdown of a piece of hardware such as a cable or connector, usually no data can move across that link.

Cisco Net Flow in the Data Center

With Flexible NetFlow, you can configure a range of parameters for traffic analysis and data export on a networking device. For instance, you can define your own records by specifying the key and nonkey fields to customize the data collection to your specific requirements. In previous versions of NetFlow, a flow was based on a set of seven IP packet attributes

Mpls Vpn QoS Hose Model

In the hose model, the service provider supplies a customer with certain guarantees for the traffic that a particular CE router would send to and receive from other CE routers in the same VPN. It is easy for a customer to implement the hose model for MPLS QoS within the VPN, because the customer does not have to perform a detailed traffic analysis or capacity planning and specify the traffic distribution between various CE routers.

Architectural Overview of NAC for Agentless Hosts

A network host tries to access the network by sending traffic. The NAD identifies a new host when it intercepts traffic. It sends out an EAPoUDP hello packet to determine whether the host is actively running the CTA service. The Termination-Action attribute defines what action a NAD should perform when a session times out. If the Termination-Action value is 1, the NAD sends another access-request packet to authenticate the agentless host. If the Termination-Action value is set to the default value of 0, the RADIUS server specifies the current posture state of the agentless host after the session timeout. The Session-Timeout value specifies how long a NAD should wait before timing out the agentless host session. The vendor-specific posture-token attribute indicates a posture token that is applied to the agentless host while the audit server is determining the current posture.

Configuring the Cisco Security Appliance to Send Syslog Messages to a Log Server

Configuring a Security Appliance to send logging information to a server helps you collect and maintain data that can later be used for forensic and data traffic analysis. The Security Appliance syslog messages are usually sent to a syslog server or servers. The Security Appliance uses UDP port 514 by default to send syslog messages to a syslog server. The syntax for configuring the Security Appliance Firewall to send syslog messages to a syslog server is as follows

Switch Port Aggregation with Ether Channel

EtherChannel also provides redundancy with several bundled physical links. If one of the links within the bundle fails, traffic sent through that link automatically is moved to an adjacent link. Failover occurs in less than a few milliseconds and is transparent to the end user. As more links fail, more traffic is moved to further adjacent links. Likewise, as links are restored, the load automatically is redistributed among the active links.

Example 254 Natpat Configuration on the wow Router

O Internet traffic from the mountain router should use the high-spegd li nk thao ne h the plains routeO1 The final two route map instances are for Internet traffic. One instance will match traffic from the mountain router, 172.16.2.10, and set the IP default next hop to the plains router, 172.16.1.3. The other instance will match traffic from the island router, 172.16.2.5, and set the IP default next hop the swamp router, 172.16.1.4. Recall that the IP default next-hop address will be used when the router does not have the destination address of the packet in its forwarding route table.

Example 249 Frame Relay Configurations for the wow plains and swar Routers

Begin by configuring the EIGRP domain between all the routers, starting with the wow router. On t wow router, you need two network statements, one for network 172.16.0.0 and one for 192.168. This router also needs to generate a default route for Internet traffic. To generate a default route, configure a default static route to the address 206.191.241.41 with the command ip route 0.0.0.C 0.0.0.0 206.191.241.41. For the wow router to advertise this route, it needs to be redistributed i EIGRP.Example 2-50 lists the configuration of EIGRP on the wow router.

LAN Switch and the OSI Model

A multilayer switch makes switching and filtering decisions based on OSI data link layer (Layer 2) and OSI network layer (Layer 3) addresses. This type of switch dynamically decides whether to switch (Layer 2) or route (Layer 3) incoming traffic. A multilayer LAN switch switches within a workgroup and routes between different workgroups.

Cable Access Technologies

Cable access is among the fastest growing technologies for home access to multiple services via a common connection. One connection to the cable company carries the television signal and Internet traffic. Most cable carriers are now getting into the voice market as well by providing voice services with unlimited long distance and other traditional services over the cable connection. The addition of teleworker functionality is a natural extension of this already multiservice connection technology.

Reconnaissance Attacks

Antisniffer tools Software and hardware designed to detect the use of sniffers on a network can be employed. Such software and hardware does not completely eliminate the threat, but like many network security tools, they are part of the overall system. These so-called antisniffers detect changes in the response time of hosts to determine whether the hosts are processing more traffic than their own. One such network security software tool, which is available from Security Software Technologies, is called AntiSniff.

Multihomed Leased Line Customers Two ISPs

BGP weight should be used in Routers A and B for all the prefixes being advertised from Router C. This is necessary to provide a safeguard against AS path prepending. It is normal practice for multihomed customers to use the AS path-prepending technique to affect the balance of the incoming traffic flows. In some cases the prepending of ASNs would break the uRPF. For example, the downstream customer prepends enough ASNs to its advertisements to Router A that Router A's best path to Router C would be through Router B. This means that the Router A-C forwarding path actually would select a Router A-B-C forwarding path. uRPF would not have a valid path for source addresses coming up the Router C-A link, effectively blocking the downstream customer's outbound traffic on the Router C-A link. A BGP weight (see Example 4-5) applied on Routers A and B would override the local effects of AS path prepends.

TCP Resets and Switches

Not all switches allow a port that is configured as the SPAN destination port to receive incoming traffic. Since the sensor's monitoring interface is usually a SPAN port on a Cisco switch, this presents a problem. If the switch does not enable the SPAN destination port to receive incoming traffic, the TCP RST packets will not be accepted, thus preventing the sensor from resetting the TCP connection. Therefore, if you are using a SPAN port to capture your network traffic and plan to use the TCP reset capability, you need to verify that your switch supports the capability to receive incoming traffic on the SPAN destination port.

Traffic Handling of Delay Sensitive Traffic

When traffic is mapped to a TE tunnel, based on TE tunnel bandwidth, a policer can be set up to police the incoming traffic and ensure it does not exceed traffic contract (in this case, tunnel bandwidth). Queuing and weighted random early discard (WRED) can be enabled on the head end and mid point nodes so that marked packets get the needed per-hop behavior to ensure the correct delivery of traffic.

Current State Authentication with 8021X

The basic premise of this overview is that host devices attempting access are challenged for valid credentials before they are allowed network connectivity. After it's authenticated and authorized, the Layer 2 switch inspects incoming traffic from the user on the authenticated authorized port and filters frames, allowing only those with the authenticated MAC address. Although 802.1X is a highly recommended and essential component for 802.1AE, it alone cannot address unauthorized access to or prevent the tampering of information traversing our networks.

Cisco IOS Firewall IDS Configuration

Because all Internet traffic comes through this connection onto the corporate network, the company has decided to configure intrusion detection on this router to provide a further layer of security against any external threats that exist. Figure 6-10 shows this simple network.

The Difficulties of Secure Networking

Because configurations for security tend to restrict traffic flows, there is very little room for error when you are trying to ensure that good traffic passes and bad traffic doesn't (assuming you are able to correctly identify the bad traffic, which isn't always the case). To compound the matter, to maintain your security system, you must receive log messages from all of your security technologies. Without log files, you won't easily be able to tell whether things are working. The volume of these messages can be very burdensome as networks increase in size. Also, patches are released for various vulnerabilities, but the vulnerabilities don't magically disappear. You still must find a way to test and apply the patches to all of your systems.

Configuring URLFiltering Policy

With URL filtering enabled, the Cisco Security Appliance stops outbound HTTP, HTTPS, and FTP traffic until a URL-filtering server permits the connection. If the primary URL-filtering server and the secondary server do not respond, then outbound web traffic (port 80) stops until the URL-filtering server comes back online. However, the allow option causes the Cisco Security Appliance to forward HTTP traffic without filtering when the URL-filtering server(s) is unavailable.

Maninthe Middle Attacks

So that you have a better understanding of a man-in-the-middle attack, I'll use Figure 2-5 to illustrate how this attack occurs. In this example, PeerA wants to send data to PeerB. PeerA does a DNS lookup for PeerB's address, shown in Step 1. However, the attacker also sees the DNS request and sends a reply back to PeerA before the DNS server has a chance, shown in Steps 2 and 3. The IP address that the attacker sends is the attacker's own IP address. PeerA knows no better and assumes that when it uses the IP address in the DNS reply that it is sending traffic to PeerB however, as shown in Step 4, the traffic actually is directed to the attacker.

Security Associations

It checks to see if an SA already exists for that peer using the desired security services. If it finds an existing SA, it places the SPI of the SA into the IPSec header and sends the packet. The destination peer takes the SPI, combines it with the IPSec protocol and the destination IP address (itself), and locates the existing SA in the Security Association Database it maintains for incoming traffic on that interface. Once it finds the SA, the destination peer knows how to unwrap the data for use.

Level of ISP Internet Access Redundancy

It's important to understand that peering and interconnection redundancy to other networks are usually provided on a global basis. In other words, if a connection to a provider becomes unavailable via the primary traffic exchange point, the next closest exchange point will be selected. The idea behind this is to not provision redundant capacity from the same location to another network, but to ensure that enough spare interconnection and backbone capacity exists to accommodate failures in one (or more) locations in the network. With this approach, provisioning more interconnection and NAP circuits in more geographically optimal locations can offset costs of the redundant connections, benefiting the network during both normal operation and failure scenarios by providing this redundancy on a global versus POP-by-POP basis. Figure 2-6 illustrates a less-than-optimal connectivity model, and 2-7 illustrates a redundant interconnection model.

Using AS path prepending to influence inbound routing

If we are a multi-homed customer of one or more service providers, we may prefer that incoming traffic take a particular path to reach our network. Perhaps we have two connections, but one costs only half as much as the other. Or, we may have one fast connection and another, much slower connection that we really only want to use a backup if our primary connection is down. Regardless of your reasons, AS path prepending is probably the easiest method that one can use to influence inbound routing to your autonomous system. Due to this huge increase in bandwidth, we would prefer that all (or, at least, the majority) of our incoming traffic come in over this much faster Ethernet connection. Since we have a connection directly to R9, however, this results in a very short AS Path in the BGP table to our prefixes. AS 99 will, by default, send any traffic for AS 67 over this 1.5 Mbit s T1 connection.

Using BGP's MED to influence inbound routing

R1 (AS 65065) is our router and R2 and R3 (AS 65001) belong to our ISP. We're going to assume that the connection between R1 and R2 is a 1.544 Mbps and that the connection between R1 and R3 is 768 kbps. We would like AS 65001 to use the faster connection (R1-R2) when sending traffic to us, and only use the R1-R3 connection as a backup. The IP network 1.1.1.0 24 has been assigned to us, and we will advertise that into BGP on R1. We can see that R3 is taking the direct path to R1 and R2 is taking the path through R3. This is contrary to what we stated earlier, We would like AS 65001 to use the faster connection (R1-R2) when sending traffic to us . Let's look into manipulating the MED to achieve our desired result. Now we have an access list named BGP_NETWORKS that matches our 1.1.1.0 24 network. Next, we need to create a route-map that we can use to set the MED value, which is 0 by default.

Configuring CBWFQ

Configuring CBWTQ comprises three basic steps Step 1 Separate your traffic into classes with class maps. Step 2 Define the QoS for each class using policy maps. Step 3 Apply the policy map to an interface. Separate Your Traffic Into Classes with Class Maps The first step in CBWFQ is to separate your traffic into different classes so you can later apply QoS to those classes. Class maps define the names of your classes and the traffic associated with each class. Consider an example. Suppose you need to define two classes with different QoS characteristics. One class of traffic is for high-priority, intranet Web (HTTP) traffic, and another class is for low-priority, casual surfing Web traffic. You might configure your class map like so The command match access-group 101 defines the match criteria for CLASS-HTTP-HI. All packets that meet the criteria in access list 101 belong to this class.

Class Based Policing

Uses access list 101 to specify SNMP, DNS, DHCP, syslog, and TFTP traffic. Class user-traffic uses a specify NetBIOS and Telnet traffic as user traffic. And class internet uses access list 103 to define H passive FTP traffic to host 10.1.1.141 as Internet traffic. These classes are each assigned traffic pol police command for each class under policy traffic-policy. Class management is assigned a 2-Mbp 375,000-byte normal burst and a 750,000-byte extended burst. Packets that conform to the norma to an IP precedence value of Flash-override (4) and transmitted. When traffic from class managem excess burst rate, it is still transmitted, but the IP precedence value for the packet is no longer cha the user-traffic class conforming to the normal traffic rate of 3 Mbps with a normal burst of 562,50 extended burst of 1,125,000 bytes has its IP precedence value set to Flash (3) and is still transmitt burst rate has been exceeded.

MAC Address Flooding

In a MAC address flooding attack, the attacker fills the switch's Content Addressable Memory (CAM) table with invalid MAC addresses. After the table is full, all traffic with an address not in the table is flooded out all interfaces. This has two bad effects more traffic on the LAN and more work for the switch. Additionally, the intruder's traffic is also flooded, so they have access

Load Balancing

The paths london-rome-sydney and london-madrid-sydney are made equal cost. When you are sending traffic with the same source and same destination IP address from new-york to sydney, all traffic takes the same path. At router london, all this traffic is forwarded out onto only one of the two possible paths. That is because of the load-balancing treatment of labeled packets in Cisco IOS. The default behavior in Cisco IOS is to look at the IP header underneath the label stack and use the same hashing algorithm as CEF to determine the load balancing. Because the default is CEF per destination load balancing, all traffic that has the same pair of source and destination IP address is switched out of the LSR onto the same path. With MPLS echo request, the default destination IP address is 127.0.0.1 in Cisco IOS. To determine the correct functioning of all possible paths on the LSRs, use different destination IP addresses.

Zoning Rules Summary

This results in two flows (192.168.1.0 24 to any, 192.168.2.0 24 to any), and you can apply different inspection parameters to the flows to configure the desired different behaviors. Zone-based policy firewalls allow inside-to-Internet traffic (the source zone inside and the destination zone outside).

IGMP Version

IGMPv3 allows hosts to filter incoming traffic based on the source IP addresses from which it is willing to receive packets, through a feature called Source-Specific Multicast (SSM). IGMPv3 is designed to support source filtering. It allows a host to indicate interest in receiving packets only from specific source addresses, or from all but specific source addresses, sent to a particular multicast address. Figure 19-15 shows basic operation of the IGMPv3 Membership Report process.

Policy routing

Figure 14.1 shows an example of a typical policy routing application. AbnerNet is connected to two Internet service providers via router Dogpatch. AbnerNet's corporate policy dictates that some users' Internet traffic should be sent via ISP 1 and other users' Internet traffic should be sent via ISP 2. If either ISP should become unavailable, the traffic normally using that provider will be sent to the other provider. A policy route at Dogpatch can distribute Internet traffic in accordance with local policy. The distribution of traffic might be based on subnet, specific user, or even user applications.

C iM 16 0LwptmckD

Configuring Sanderz for recursive lookups enables the network administrator to redirect all of that router's exit traffic from Heffalump to Woozle by changing one route entry. Figure 3.12. Configuring Sanderz for recursive lookups enables the network administrator to redirect all of that router's exit traffic from Heffalump to Woozle by changing one route entry.

The Core Block

A core block is required to connect two or more switch blocks in a campus network. Because all traffic passing to and from all switch blocks, server blocks, the WAN block, and the Internet must cross the core block, the core must be as efficient and resilient as possible. The core is the basic foundation of the campus network and carries much more traffic than any other block.

SVC Implementation

The SVC implementation is much more dynamic and resilient than the PVC implementation. Why Simply because SVCs are set up on demand, without manual intervention. If traffic needs to get from point A to point Z, signaling sets up the VC dynamically, using either a static or a dynamic ATM routing protocol, through the ATM cloud. After the VC is set up, the traffic can flow through, utilizing the preset path. After the VC is set, all the traffic from source to destination takes the same path. The beauty of an SVC is that you do not have to worry about ATM network availability (provided, of course, that the entire ATM cloud is alive) If a problem exists with one of the links that is used for a preset VC, a new VC is set up for your traffic dynamically, using Q.2931 signaling. Several methods exist for SVC setup, using static routes or dynamic routing protocols that discussion is outside the scope of this book, however, and can be found in Cisco ATM Solutions.

Frame Relay

Now imagine that the phone company salesperson talks to you when you have two leased lines, or circuits, installed as in Figure 4-7 You know, we can install Frame Relay instead. You will need only one serial interface on R1 and one CSU DSU. To scale to 100 sites, you might need two or three more serial interaces on R1 for more bandwidth, but that's it. And by the way, because your leased lines run at 128 kbps today, we'll guarantee that you can send and receive that much to and from each site. We will upgrade the line at R1 to T1 speed (1.544 Mbps). When you have more traffic than 128 kbps to a site, go ahead and send it If we've got capacity, we'll forward it, with no extra charge. And by the way, did I tell you that it's cheaper than leased lines anyway

Network Robustness

Routers to share a single IP address. Therefore, when hosts are configured with the IP address of the default gateway, the shared address is used. One of the routers sharing the address is active. If the active router fails, a backup resumes receiving and sending traffic. Hosts have no knowledge of the failure, or even that multiple routers are forwarding its traffic off the LAN segment. VRRP is an open standard based on Cisco's HSRP. Cisco IOS Software does not support VRRP, so this book does not discuss it. HSRP is further discussed m the following section.

More Products