-: At this point, we've covered the basics 2 2
of ethernet with the cabling and the cable types 3 3
and some of the devices like routers 4 4
and switches and bridges and hubs, 5 5
but there's a lot more to ethernet out there. 6 6
And we're going to dive into that in this video. 7 7
When we talk about additional features of ethernet, 8 8
these features are there to enhance the network performance, 9 9
the redundancy, the security, the management, 10 10
the flexibility, or the scalability of our networks. 11 11
All of these are great things, 12 12
and we use different features and different devices 13 13
to give us these abilities. 14 14
Now, some of the common switch features 15 15
that we have are things like virtual LANs 16 16
or VLANs, trunking, spanning tree protocol, 17 17
or STP, link aggregation, 18 18
power over ethernet or POE, 19 19
port monitoring and user authentication. 20 20
The first three of these, VLANs, 21 21
trunking and STP are a little bit more in depth. 22 22
So we're going to cover each of those in their own video 23 23
as we go through the rest of the section. 24 24
But for this video, 25 25
we're going to focus on link aggregation, 26 26
power over ethernet, port monitoring, 27 27
and user authentication. 28 28
First, let's talk about link aggregation, 29 29
and this falls into the IEEE 802.3ad standard. 30 30
Now, if you're taking notes as we go along, 31 31
I want you to write this down. 32 32
Anytime you see a standard like IEEE 802.3ad, 33 33
you want to write it down and what it is. 34 34
So write down link aggregation 802.3ad, 35 35
because you're going to see questions on the test 36 36
where the answer is either listed as the number 37 37
like 802.3ad or they might ask you 38 38
something like, what is 802.3ad? 39 39
And you need to be able to answer that it's link aggregation 40 40
or power over ethernet 41 41
or port monitoring or stuff like that. 42 42
Now it's going to be important as we go through, 43 43
to write these things down and remember them. 44 44
With link aggregation, we have a problem in our networks, 45 45
and that is congestion can occur 46 46
when all the ports are operating at the same speed. 47 47
If you have 100 megabits per second network, 48 48
and each switch port on that network 49 49
can operate at 100 megabits per second, 50 50
this isn't a problem if everyone's taking their turn. 51 51
But if you remember in our last lesson, 52 52
we talked about the fact that switches are full duplex, 53 53
which means that every port can operate 54 54
at 100 megabits per second. 55 55
If I have three ports and I have PC one, two and three, 56 56
all sending data in at 100 megabits per second, 57 57
well guess what? 58 58
That means to send it out, 59 59
I need at least 300 megabits per second, 60 60
but that output port 61 61
is still only 100 megabits per second. 62 62
And that can cause a bottleneck 63 63
where traffic can be dropped, as shown in this picture. 64 64
Now to solve this, we use what's called link aggregation. 65 65
Now what link aggregation does is combine physical 66 66
multiple connections into a single logical connection. 67 67
So let's say I have a 24 port switch. 68 68
I can use 20 ports of that as service 69 69
for 20 different machines, and then take four ports 70 70
and combine them together 71 71
to give me one virtual 400 megabit per second connection. 72 72
This will help alleviate the congestion 73 73
by increasing the amount of bandwidth available 74 74
for uplink to the next router or switch. 75 75
Now, if I have four connections out 76 76
and I have 20 connections coming in, 77 77
is there a possibility there's going to be a backup? 78 78
Well, yes, but it's not going to necessarily happen 79 79
all the time. 80 80
In fact, it's really rare that every PC on your network 81 81
is using all 100 megabits of its network 82 82
every time, at the same time, 83 83
if you have a 24 port switch, 84 84
you're pretty safe using four ports for link aggregation. 85 85
And that way, you can use the 802.3ad protocol 86 86
to do this for you. 87 87
Next, we have power over ethernet. 88 88
There are two variants of this, 89 89
the power over ethernet and power over ethernet plus. 90 90
Now power over ethernet is 802.3af. 91 91
Power over ethernet plus is 802.3at. 92 92
But I would write both of these down 93 93
as part of your memorization guide. 94 94
Now the idea of power over ethernet 95 95
is that you can supply electrical power 96 96
to devices over ethernet. 97 97
That's the entire purpose of it. 98 98
The benefit of this is that if I'm using 99 99
a CAT five or higher cable, 100 100
I only need a cable to give both power and data to something 101 101
as opposed to having a power cable and a data cable. 102 102
Now, each cable can provide you 103 103
with up to 15.4 Watts of power to that device. 104 104
With power over ethernet, plus this actually can go up 105 105
to 25.5 Watts of power 106 106
because it does support a higher wattage. 107 107
Now, both of those numbers are things I would also add 108 108
to your memorization sheet. 109 109
So for power over ethernet, it's 15.4 Watts 110 110
and power over ethernet plus, it's 25.5 Watts. 111 111
There are two types of devices out there. 112 112
We have power sourcing equipment and power devices. 113 113
The power sourcing equipment or PSE, 114 114
is what is going to provide the power to our other devices. 115 115
This would normally be your switch. 116 116
Now the power devices are things like your phone 117 117
or a wireless access point. 118 118
These are the devices that are getting power over ethernet 119 119
and pulling it from our powered sourcing equipment, 120 120
like our switches. 121 121
Now all of this is going to occur over an RJ 45 connector 122 122
using a CAT five or higher cable. 123 123
Now the next one we have is what's known 124 124
as port monitoring or port mirroring. 125 125
This is not necessarily a number or a standard 126 126
you have to memorize, 127 127
but you do need to understand the concept of it. 128 128
Now we talk about port monitoring, 129 129
it's helpful to analyze packet flow over a network. 130 130
Each switch port is its own collision domain 131 131
as you remember from our last lesson, 132 132
you can't listen from PC one to PC two 133 133
if you're not PC one or PC two, 134 134
because there's going to be 135 135
that individual connection for them. 136 136
Well, if you wanted to listen to that traffic 137 137
because you need to do something for your security system, 138 138
you have to connect a network sniffer to a hub, 139 139
and then you'd be able to hear everything 140 140
because hubs broadcast everything to every port, 141 141
or you can do it in a switch by setting up 142 142
a port monitoring or port mirroring. 143 143
Now, what you do here 144 144
is if you have a 24 port switch, for instance, 145 145
and all your traffic is going from port one through port 23, 146 146
you can then have it all mirrored out over port 24 147 147
and attach your sensor there, your network analyst machine, 148 148
and be able to collect that data and read it. 149 149
Now for this to work, your switch requires 150 150
that port mirroring or port monitoring 151 151
is set up on the device and configured 152 152
to allow all that traffic to be mirrored 153 153
and copied over to that 24th port. 154 154
In the case of this envelope 155 155
that we want to send from PC one to PC two, 156 156
we get a copy of that's made as it's sent over the network 157 157
to the network analyst machine, 158 158
as well as by the switch over through port mirroring, 159 159
the port mirroring is going to make that copy and send it over 160 160
so we can analyze it using something 161 161
like a network analyst tool 162 162
like Wireshark or some other network sensor. 163 163
Next, we have user authentication 164 164
and there is a number for this one, it's 802.1x. 165 165
Now for security purposes, 166 166
switches can require users to authenticate themself 167 167
before they get access to the network. 168 168
And 802.1x is going to allow us to do just that. 169 169
Once you're authenticated, there's a key 170 170
that's generated and it will be shared 171 171
between the supplicant, 172 172
which is the device wanting to access it 173 173
like your laptop or your desktop and the switch itself, 174 174
which we call the authenticator. 175 175
So how this works is shown here on the screen, 176 176
and you see the supplicant, 177 177
which is PC one, is going to first talk to the switch. 178 178
And it's going to ask for permission to join the network. 179 179
That's when it's going to send it straight through 180 180
to the authentication server 181 181
and the authentication server is going to check 182 182
the supplicant's credentials 183 183
and create a key for it if it's authorized, 184 184
then that key is used to encrypt traffic 185 185
between the switch and the client. 186 186
You can see here with the key distribution 187 187
going from the authentication server 188 188
to the authenticator, and then the key management 189 189
goes from the authenticator to the switch, to the PC. 190 190
At that point, both the switch and the PC have the same key, 191 191
and we can create a symmetric encryption tunnel, 192 192
which will secure all of our data. 193 193
We will talk more about this process in a future lesson. 194 194
As we dive into the security of 802.1x. 195 195
Next, we have management access and authentication. 196 196
To configure a manage our switches, 197 197
you can do two different things. 198 198
You can use SSH to do it and do it remotely. 199 199
Or you can use a console port and do it locally. 200 200
With SSH or Secure Shell, it's going to operate over port 22. 201 201
And it's a remote administration program 202 202
that allows you to connect to your switch over your network. 203 203
Anywhere I'm sitting on the network, 204 204
I can SSH into that switch and never have to get up 205 205
from my desk, this way I can go and remotely manage it. 206 206
Now, if I want to use a console port instead, 207 207
I have to be there locally to plug into it. 208 208
I would use an RS 232 serial cable, 209 209
which we call a rollover cable, which has one end 210 210
as an RJ 45 and the other end as a DB nine. 211 211
And I'd be able to plug my laptop into the console port 212 212
of a switch, and then when I'm physically connected to it, 213 213
I can then go in and be able to access it 214 214
and make different connections and configurations. 215 215
Now, which one should you use? 216 216
Well, this is going to depend 217 217
on the security level of your network. 218 218
It is more secure to do it locally 219 219
than it is to do it through SSH over the network. 220 220
But there's actually a third way 221 221
that uses the benefits of both. 222 222
And this is known as an out of band management network. 223 223
Essentially, you create another network 224 224
that sits on top of your network 225 225
that you use for your data. 226 226
And this network is only used to be able 227 227
to connect to devices and configure them. 228 228
Now you can do this out of band network 229 229
by having a separate network configuration 230 230
on this separate physical devices. 231 231
And this way we might have a 24 port switch 232 232
that connects to each of the other switches in our network. 233 233
And that becomes our out of band network. 234 234
We call it out of band because it is out 235 235
of the normal band of where we send data. 236 236
So we have this management network 237 237
and then we have this data network. 238 238
Now all of my management devices are on one network 239 239
and all of my data transfer is on the other network. 240 240
This way you have additional security to make sure 241 241
all your configurations aren't touchable by the end users. 242 242
And only by your system administrators 243 243
who have permission to be on the out of band network. 244 244
Now, the next thing we need to think about 245 245
is this thing called first-hop redundancy. 246 246
Now this has to do with layer three switches and routers. 247 247
When we deal with first hop redundancy, 248 248
we use protocols like HSRP, 249 249
which is the hot standby router protocol. 250 250
Essentially, it's going to create 251 251
a virtual IP address and a virtual Mac address. 252 252
And this curtain creates an active and a standby router. 253 253
So in the case that you can see here on the screen, 254 254
you'll see I have three routers displayed. 255 255
I have an active router, which is the .one router. 256 256
I have a standby rider, which is the .two. 257 257
And I have a virtual router which is the .three. 258 258
Now in the real world 259 259
if I walk over to my networking cabinet, 260 260
there's not three routers. 261 261
There's only two physical routers standing there, 262 262
the active and the standby, 263 263
but my configured PC only sees one router. 264 264
They see the virtual router, .three. 265 265
So when my PC wants to communicate out, 266 266
it communicates to the virtual router on .three. 267 267
That way, it connects to the virtual router. 268 268
And then the virtual router will know, 269 269
based on which router's currently up, 270 270
the active or standby, which one to send the traffic to. 271 271
This is what the HSRP protocol does. 272 272
We're going to go into much more depth on first hop redundancy 273 273
later on when we get into the router section of this course. 274 274
But for right now, 275 275
I just wanted to introduce you to the idea, 276 276
because if you're dealing with a layer three switch 277 277
or a multi-layer switch, 278 278
you might have to deal with first hop redundancy. 279 279
Now, the other thing to know 280 280
is that HSRB is not the only first hop redundancy protocol. 281 281
There's also the gateway load balancing protocol, 282 282
known as GLBP. 283 283
There's also the virtual router redundancy protocol or VRRP. 284 284
There's common address redundancy protocol or CARP, 285 285
but HSRP, the hot standby routing protocol 286 286
is the most popular that's used in most networks today. 287 287
All of these work pretty much the same way. 288 288
And for the exam, you just need to remember 289 289
that they're all first hop redundancy protocols. 290 290
When we get into routing later, 291 291
we're going to talk more in depth about them and how they work, 292 292
but for now, that's what you need to know. 293 293
The next thing we want to talk about is MAC filtering, 294 294
which is a layer two function, which again, 295 295
we're dealing with switches, so that's really important. 296 296
MAC filtering is the process of allowing or denying traffic 297 297
based on a device's Mac address. 298 298
And this can be used to help improve security. 299 299
It's one of many layers of security we can add, 300 300
but honestly, it's really not that strong of one, 301 301
but it is one that we do need to talk about for the exam. 302 302
Because according to the network plus exam, 303 303
you should use it. 304 304
Now, how does Mac filtering work? 305 305
Well here on the screen, 306 306
you'll see I have a wireless access point. 307 307
We have a wired desktop, a wireless desktop 308 308
and a wireless printer. 309 309
If I wanted to make sure the only the wired desktop 310 310
could talk to the printer, 311 311
I can actually block the wireless desktop 312 312
by its Mac address. 313 313
We can tell the switch that if it comes from Mac address A, 314 314
it's allowed, if it comes from Mac address B, 315 315
you can block that traffic. 316 316
Next, we have traffic filtering 317 317
and traffic filtering is kind of like Mac filtering, 318 318
except instead of doing it at the Mac address layer, 319 319
we're going to do it at the logical layer 320 320
using IP addresses or ports 321 321
Now, this is where we start talking about things 322 322
like layer three and layer four. 323 323
And so we have to deal with this on a router 324 324
or a multi-layer switch. 325 325
So for example, if I have PC one, 326 326
trying to talk to PC two, 327 327
I can block it at the multi-layer switch. 328 328
Seeing that anything coming from the address, 329 329
192.168.1.100 is not allowed. 330 330
I might put it on my blacklist and block it. 331 331
Anything coming from 192.168.1.101 is allowed. 332 332
And so it's on my white list and I'll add it in. 333 333
Or I might do this based on ports. 334 334
And I can say anything coming over port 25 335 335
is allowed because there are mail servers, 336 336
but anything coming from port 53 53 is not allowed. 337 337
And I'm going to block them. 338 338
This is the idea of traffic filtering. 339 339
I can block it based on an IP address, 340 340
or I can block it based off your port address. 341 341
And that way, I can do it at layer three or layer four. 342 342
If I want to do it at layer two, 343 343
I use Mac address, layer three, IP addresses, 344 344
layer four, ports. 345 345
Either way I want to do it, it's okay. 346 346
I can do this. Using an access control list, 347 347
and we'll talk a lot more about access control lists 348 348
when we talk about firewalls 349 349
because that is exactly how they do things. 350 350
Last, we want to talk about quality of service 351 351
and quality of service is going to forward your traffic 352 352
based on different priority markings. 353 353
We have this switch, this multi-layer switch shown here, 354 354
I have three devices that are connected to it. 355 355
PC one, PC two, and a phone. 356 356
Well, because phones are dealing with UDP voice traffic, 357 357
I want to make sure it has a higher priority. 358 358
So it gets first in, first out priority. 359 359
Now, if I pick up the phone and I start talking, 360 360
I want to make sure the packets are dropped 361 361
so I don't have my voice going in and out as I'm talking. 362 362
With PC1 and PC2, I can make those lower priorities 363 363
and they'll get a lower level of service. 364 364
And that's okay, because if they're using TCP, 365 365
they'll just retransmit what's dropped and do it again. 366 366
Now, in this example, 367 367
you can see PC one has a higher priority than PC two, 368 368
but the phone has a higher priority 369 369
than both PC one and PC two. 370 370
Now later on in the course, 371 371
we're going to dive deep into the idea of quality of service. 372 372
We'll spend a couple of videos on it in fact, 373 373
because it's a really important concept, but for now, 374 374
I just want you to understand that you can tell a switch 375 375
or a router what is more important 376 376
and what should get higher priority, 377 377
which one is essentially the VIP. 378 378
That's the idea of quality of service.