Please enable JavaScript.
Coggle requires JavaScript to display documents.
Network Designs, CORE, 1.TCP/IP basic knowledge
Ethernet | IP | ICMP |…
-
CORE
DIST
ACC
the access layer if where we connect all our end devices .. they could be laptops, they could be access points,
- end devices
- network devices
- wireless clients
- ip phones
- cameras (pan tilt and zoom cameras ) vidro conferences systems
Network services
- Vlan Assignment
as the traffic comes in into the network into the access layer switch (from end devices) traffic is not tagged (we could download somesoftware that tags our own machine trafffic, phones does tag their own traffic and in that case we should decide weither to trust them or not, but in most cases traffic is not self device tagged ) it is tagged by the access sws
- QoS marking, shaping, poliocing , queing, buffering
for marking same concept as VLAN Assign (unmarked > marked with high priority, low priority .. )
- SGTs Security Groups tags
- Trust Boundaries
-
what we think of lot times is our classic core dist layer .. this concept is usually within a single site so if we are gonna have our core siwtchs and we have our headquarters which located physically in our quarters
and so we have our dist layer hangin out of the Core nlock and our Access Switchs handing our of the Dist layer
-
DIST
what if we have another building thats coming into the core via fiber for example and not coming via WAN connection (lmps circuit.. wan tls)
maybe we are a campus env which which we might be having one or 15 buildings to add distribution and access switchs
-
-
WAN
one thing we have talked about is having second site or other sites and all coming through the WAN
so all our other braches are gonna be coming rhough the WAN which contain all the switches and routers
-
I
I have its own block and have its own set of routers and firewalls.. whatever make the internet work are in this component
-
Net Svcs (optional)
Net Svcs will be things like firewall, application load balancer, a wan , acceleration engine.. those kind of devices in large enterprises that will be deployed into their own set of switchs and if are deplying them into their own switchs we might just rather l3 connecting them to the core block .. and in that case they will be having their own block
in most cases we dont usually do this and out all of our network services our in their own block .. basically if we only have a firewall a lan controller and 5 or 6 devices of this kind we just might wanna put them where they make more sense and not their own block
- wireless LAN controller > Dist Block
- Firewalls > internet Block
we start with the idea of havin a core block in the middle of our network
this rack consist of 2/3 switchs a bunch of routers depends on the network
usually a multilayer switchs
the idea is that we have our core block and we can hang all our other network nlocks of this network block
this is similar to the hub topoloy .. the core block bieng the hub and our netwok components are the spokes which are the other blocks in the net
if we wanna set any traffic across the nework we send it to the core and the core sends it to whichever direction it needs to go
-
-
CORE-R1
-
-
-
- Basic settings to all devices plus ssh on the routers and l3 switches
- VLANs assignment plus all access and trunk ports on l2 and l3 switches
- Switchport security to finance department
- Subnetting and IP Adressing
- OSPF on the routers and l3 switches
- Static IP address to serverRoom devices
- DHCP server device configs
- interVLAN routing on the l3 switches plus ip dhcp helper addresses
- Wireless network configs
- PAT + Access control list
- Verifying and testing configs
-
-
-
CORE-R1
-
-
-
-
-
- Basic settings to all devices plus ssh on the routers and l3 switches
- VLANs assignment plus all access and trunk ports on l2 and l3 switches
- Switchport security to finance department
- Subnetting and IP Adressing
- OSPF on the routers and l3 switches
- Static IP address to serverRoom devices
- DHCP server device configs
- interVLAN routing on the l3 switches plus ip dhcp helper addresses
- Wireless network configs
- PAT + Access control list
- Verifying and testing configs
-
chap 3 > VLANs
-
intro
L’une des technologies permettant d'améliorer les performances reseau, consiste à diviser de vastes domaines de diffusion en domaines plus petits
Le rôle principal d’un routeur est de déplacer les données entre les réseaux, pas de fournir l’accès réseau aux périphériques finaux qui est un role généralement réservé au commutateur
Un réseau local virtuel (VLAN) peut être créé sur un commutateur de couche 2 pour réduire la taille des domaines de diffusion, de sorte qu’elle soit équivalente à celle d’un périphérique de couche 3
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
chap 6 > Types de protocoles Spanning Tree Protocol (STP)
PVST+, Rapid STP, Rapid PVST+
-
Protocole PVST+
Fonctionnement de PVST+
Pour chaque VLAN d’un réseau commuté, le protocole PVST+ exécute quatre étapes pour offrir une topologie de réseau logique sans boucle
- Sélection du port racine sur chaque commutateur non-pont racine
Le port racine est le chemin le plus économique depuis le pont non racine jusqu’au pont racine, indiquant ainsi la direction du meilleur chemin jusqu’au pont racine
- Sélection du port désigné pour chaque segment
Ce port désigné est choisi sur le commutateur présentant le coût de chemin le plus bas vers le pont racine.
- Détermination d’un pont racine
- Les autres ports du réseau commuté sont des ports alternatifs
Les ports alternatifs restent normalement en état de blocage, afin de rompre logiquement la topologie de boucle
-
-
Configuration PVST+
Lorsqu’un administrateur souhaite définir un commutateur spécifique en tant que pont racine, sa valeur de priorité de pont doit être modifiée de manière à ce qu’elle soit inférieure à la valeur de priorité de tous les autres commutateurs du réseau.
-
Presentation
Créer une instance pour chaque VLAN augmente les besoins en processeur et en mémoire, mais permet d’utiliser plusieurs ponts racine par VLAN.
Avec PVST+, il est possible pour le port trunk d’un commutateur d’être bloqué pour un VLAN donné, mais ouvert pour les autres VLAN.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
when we first grow our nets organically this is the kind of thing that we kinda develop
and we have other distant users who we wanna connect and so we add another switch our ther or maybe a hub back and the days to connect them and we connect it to the rest of the netowrk and hopefully we are running stp so that there arent any loops and hope ther it work
and we add more as we gron and hope that works
this could work exept now when we add access to the internet to this switch
and we might need bunch of servers and as we grom more we have problems adding more users and more servers as and so we begin having panic attacks
we need models to tells us what is the best way to build networks
we need building blocks
we need a way to majorarly manage our netowkrs
and this model can grow well .. adding another building we can just add a Dist/Acc blocks with their internet circuit .. needing a second DC we add it.. need more wan circuits well just have more wan circuits coming in the wan block
- something cisco likes us to know is .. what type of services are running on each of these blocks and layers
usually a block will be represented by 2 Sws .. biggest exception of this is our access layer which can be lot of switchs.. as many as much as we can connect all our users
the way 2 blocks will be connecting is bringing the 2 Sws from each for example and brings all of this together in a form of a full mesh connectivity .. and all of those connections are L3 connectivity thats why its scale so well ..
why not L2
we dont wanna push L2 everywhere we dont need L2 for example beween our headquarters and our manifacturing building across the way
and the way we help maintains this with time (servers/control) is have all of that in our DC space (lot of our l2 needs and requirments happens between servers) and all our servers being on the same spot (DC) we can have l2 there and not needing to push it to the rest of the network
why L3/ Challenges
- L3 gives us lot of scalability comes down to (raining in broadcast domains , raining in the spanning tree domain, making it so that we can have new subnets at every location ) the
- down side of l2 is the inability to share subnets broadcast domains between locations.. but again there almost is never a reason why building 2 will have to be on same subnet as building 1
almost all our appication were gonna be pushing are able to talk across l3 boundary
we might hve wireless devices that have to be on the same subnet .. pple roam between 2 buildings that can be a challenge and we can get around that with tunneled wireless protocols like capwap going through wireless LAN controllers
beside software defined networking our physical network architecture also matters and if we physically have our dist switch connecting to our core switch this way and then we need to configure it appropriately (we need to be able to do lot of L3 everywhere , the more we can do it the more we be prepared to deploy campus fabric )
Campus architecture model (Classic )
-
service provider that providing the connecting to all the other sites and after that we might need to find a diffrent service provider bicuz mybe the first one dosent reach some of the other sites and so we end up using a second one .. in such cases where for example we are preforming a critical mission also we might need a second WANSP (2nd cloud)
having a second SP that is providing secondary connecton between to our sitres we can start looking wher ecomplexity is increasing bicuz now we have a second path to all the diffrent routers between the HQ/DC and sites and we need to make sure our routing domains can handle a failiure
if for example connecting goes of some site what can all goes wrong..
- is my routing domain gonna converge with the second path we provided or fail over
- is my application gonna be inaccessible
- are our users gonna get disconnected from the services that they were running to the DC..
on top of that we have to worry about diffrent media types E1s T1s, metroEthernet connections, MPLS, VPN across the ethernet
- also managing applications by priorities from diffrent sites
WAN SP is multitenant meaning they have lot of clients across this WAN and when we are running mpls for example meaning that we are exchanging routes with our SP meaning we are trusing our SP to advertise routes to our other sites and not other customers..
- encryption .. Also is this traffic encrypted ? these routes are not IPset tunnels and theyre not enc by default.
- meanagebilitty.. also we need to manage all edge routers / dual home connections at hundred locations...
- visibility.. on how applications on diffrent sites are doing .. performance how things are doing on this WAN
lot of things are gonna be solved with how we do things now > SD WAN
how SD WAN is any diffrent
- Overlay/underlay
- Controller
when we say SD software defined we are usually talking about what we call an overlay/underlay
to explain this lets we have a network with 5 physical routers
we dont necessarily want our topo to look like theyre physically connected (pys) and so instead we map these device into a new logical topology which we might having it looking like this
what we did is we connected those 4 devices into the middle one to gives us this which more preferred to run some sec and identify some traffic .. etc
the way we accomplish this is with the concept of tunnels
tunnels are great to give us the topology we want but difficult to all manage with lot of them
so what we do is create 4 tunnel interface on the middle router going to the 4 other routers
- Underlay is that actual physical network
- Overlay is drown over (tunneled topology / logical network)
going back to our actual wan network and bicuz now we are capable of using tunnels
and so we create a tunnel (IPsec) from site across the primary wan sp (overlay on top of the physical path) and one other across the secondary wan
and so for example if the physical path across the secondary wan goes down the logical network dosent change but reHome to the primary wan .. on which will have then 2 tunnels the same physical network
and yes the redundancy is gone having to use one physical network path but still as much as WAN SP we are using we can always keep our tunnels up and topology stays the same
we no longer need to share our routes with the SP bicuz routes that we are connecting are subnets (DC<subA, Site3<subB) and so we no longer need to advertise our routes across the SP .. my destination traffic which is encapsulated into the tunnel will always be a router that is directly attached ..
- Also as admin we can do our work by loggin in into a single controller and no longer need to manage every single router in this topology .. this one management interface is going to give us access to all application aware policies ..
when were talking about sdwan we are talking about connecting dfiffrent buildings / work locations Bank>Branches HQ/DC>Sites
-
building an architecture like this we need to know how is this going to operate from a subnetting prespective..
if we create a subnet that subnet will belong to a broadcast domain and we know that broacasting is bad in networking (ethernet is terible protocol and cant handle braodcasting very well )
there many services that needs broacasting DHCP.. and so with that much broacasting traffic being created by our end devices we need to contain this broacast domains
and we gonna up to 254/514 devices within one single broacast domain but at some point cant handle all of this broadcast traffuc
Also we need to have some clients within the same broadcast domain/ also we jave services that are relying on recving and broadcasting (windows and printing services) we find ourselfs want our clients to be on the same subnet and also shrinking these subnets down and so we find ourselfs in this problematic of how big we want our broadcast domain to be
-
also there is the problem of wireless.. connecting from one wireless access point .. roaming and walking down the hall and suddently we are connecting to another one
-
-
-