1 1 00:00:00,490 --> 00:00:02,340 At this point, we've covered the basics 2 2 00:00:02,340 --> 00:00:04,990 of ethernet with the cabling and the cable types 3 3 00:00:04,990 --> 00:00:06,870 and some of the devices like routers 4 4 00:00:06,870 --> 00:00:08,820 and switches and bridges and hubs, 5 5 00:00:08,820 --> 00:00:10,910 but there's a lot more to ethernet out there. 6 6 00:00:10,910 --> 00:00:13,460 And we're going to dive into that in this video. 7 7 00:00:13,460 --> 00:00:15,790 When we talk about additional features of ethernet, 8 8 00:00:15,790 --> 00:00:18,510 these features are there to enhance the network performance, 9 9 00:00:18,510 --> 00:00:21,380 the redundancy, the security, the management, 10 10 00:00:21,380 --> 00:00:24,450 the flexibility, or the scalability of our networks. 11 11 00:00:24,450 --> 00:00:26,200 All of these are great things, 12 12 00:00:26,200 --> 00:00:28,710 and we use different features and different devices 13 13 00:00:28,710 --> 00:00:30,520 to give us these abilities. 14 14 00:00:30,520 --> 00:00:32,370 Now, some of the common switch features 15 15 00:00:32,370 --> 00:00:34,550 that we have are things like virtual LANs 16 16 00:00:34,550 --> 00:00:37,840 or VLANs, trunking, spanning tree protocol, 17 17 00:00:37,840 --> 00:00:40,470 or STP, link aggregation, 18 18 00:00:40,470 --> 00:00:42,750 power over ethernet or POE, 19 19 00:00:42,750 --> 00:00:45,370 port monitoring and user authentication. 20 20 00:00:45,370 --> 00:00:47,440 The first three of these, VLANs, 21 21 00:00:47,440 --> 00:00:50,560 trunking and STP are a little bit more in depth. 22 22 00:00:50,560 --> 00:00:53,340 So we're going to cover each of those in their own video 23 23 00:00:53,340 --> 00:00:55,210 as we go through the rest of the section. 24 24 00:00:55,210 --> 00:00:56,380 But for this video, 25 25 00:00:56,380 --> 00:00:58,490 we're going to focus on link aggregation, 26 26 00:00:58,490 --> 00:01:00,540 power over ethernet, port monitoring, 27 27 00:01:00,540 --> 00:01:02,350 and user authentication. 28 28 00:01:02,350 --> 00:01:04,810 First, let's talk about link aggregation, 29 29 00:01:04,810 --> 00:01:09,540 and this falls into the IEEE 802.3ad standard. 30 30 00:01:09,540 --> 00:01:11,500 Now, if you're taking notes as we go along, 31 31 00:01:11,500 --> 00:01:13,190 I want you to write this down. 32 32 00:01:13,190 --> 00:01:17,480 Anytime you see a standard like IEEE 802.3ad, 33 33 00:01:17,480 --> 00:01:19,350 you want to write it down and what it is. 34 34 00:01:19,350 --> 00:01:23,800 So write down link aggregation 802.3ad, 35 35 00:01:23,800 --> 00:01:25,760 because you're going to see questions on the test 36 36 00:01:25,760 --> 00:01:27,860 where the answer is either listed as the number 37 37 00:01:27,860 --> 00:01:29,971 like 802.3ad or they might ask you 38 38 00:01:29,971 --> 00:01:33,400 something like, what is 802.3ad? 39 39 00:01:33,400 --> 00:01:35,870 And you need to be able to answer that it's link aggregation 40 40 00:01:35,870 --> 00:01:37,160 or power over ethernet 41 41 00:01:37,160 --> 00:01:39,660 or port monitoring or stuff like that. 42 42 00:01:39,660 --> 00:01:41,420 Now it's going to be important as we go through, 43 43 00:01:41,420 --> 00:01:43,630 to write these things down and remember them. 44 44 00:01:43,630 --> 00:01:46,630 With link aggregation, we have a problem in our networks, 45 45 00:01:46,630 --> 00:01:48,310 and that is congestion can occur 46 46 00:01:48,310 --> 00:01:51,140 when all the ports are operating at the same speed. 47 47 00:01:51,140 --> 00:01:53,440 If you have 100 megabits per second network, 48 48 00:01:53,440 --> 00:01:55,010 and each switch port on that network 49 49 00:01:55,010 --> 00:01:57,260 can operate at 100 megabits per second, 50 50 00:01:57,260 --> 00:02:00,110 this isn't a problem if everyone's taking their turn. 51 51 00:02:00,110 --> 00:02:02,340 But if you remember in our last lesson, 52 52 00:02:02,340 --> 00:02:05,520 we talked about the fact that switches are full duplex, 53 53 00:02:05,520 --> 00:02:07,390 which means that every port can operate 54 54 00:02:07,390 --> 00:02:09,290 at 100 megabits per second. 55 55 00:02:09,290 --> 00:02:12,320 If I have three ports and I have PC one, two and three, 56 56 00:02:12,320 --> 00:02:15,270 all sending data in at 100 megabits per second, 57 57 00:02:15,270 --> 00:02:16,280 well guess what? 58 58 00:02:16,280 --> 00:02:17,520 That means to send it out, 59 59 00:02:17,520 --> 00:02:20,200 I need at least 300 megabits per second, 60 60 00:02:20,200 --> 00:02:21,610 but that output port 61 61 00:02:21,610 --> 00:02:23,810 is still only 100 megabits per second. 62 62 00:02:23,810 --> 00:02:25,300 And that can cause a bottleneck 63 63 00:02:25,300 --> 00:02:28,440 where traffic can be dropped, as shown in this picture. 64 64 00:02:28,440 --> 00:02:31,940 Now to solve this, we use what's called link aggregation. 65 65 00:02:31,940 --> 00:02:34,820 Now what link aggregation does is combine physical 66 66 00:02:34,820 --> 00:02:38,290 multiple connections into a single logical connection. 67 67 00:02:38,290 --> 00:02:40,950 So let's say I have a 24 port switch. 68 68 00:02:40,950 --> 00:02:43,220 I can use 20 ports of that as service 69 69 00:02:43,220 --> 00:02:46,030 for 20 different machines, and then take four ports 70 70 00:02:46,030 --> 00:02:47,550 and combine them together 71 71 00:02:47,550 --> 00:02:51,320 to give me one virtual 400 megabit per second connection. 72 72 00:02:51,320 --> 00:02:53,200 This will help alleviate the congestion 73 73 00:02:53,200 --> 00:02:55,140 by increasing the amount of bandwidth available 74 74 00:02:55,140 --> 00:02:57,720 for uplink to the next router or switch. 75 75 00:02:57,720 --> 00:02:59,400 Now, if I have four connections out 76 76 00:02:59,400 --> 00:03:01,340 and I have 20 connections coming in, 77 77 00:03:01,340 --> 00:03:03,750 is there a possibility there's going to be a backup? 78 78 00:03:03,750 --> 00:03:06,740 Well, yes, but it's not going to necessarily happen 79 79 00:03:06,740 --> 00:03:07,880 all the time. 80 80 00:03:07,880 --> 00:03:11,080 In fact, it's really rare that every PC on your network 81 81 00:03:11,080 --> 00:03:13,750 is using all 100 megabits of its network 82 82 00:03:13,750 --> 00:03:15,690 every time, at the same time, 83 83 00:03:15,690 --> 00:03:17,510 if you have a 24 port switch, 84 84 00:03:17,510 --> 00:03:20,470 you're pretty safe using four ports for link aggregation. 85 85 00:03:20,470 --> 00:03:23,530 And that way, you can use the 802.3ad protocol 86 86 00:03:23,530 --> 00:03:25,180 to do this for you. 87 87 00:03:25,180 --> 00:03:27,700 Next, we have power over ethernet. 88 88 00:03:27,700 --> 00:03:29,270 There are two variants of this, 89 89 00:03:29,270 --> 00:03:32,620 the power over ethernet and power over ethernet plus. 90 90 00:03:32,620 --> 00:03:36,710 Now power over ethernet is 802.3af. 91 91 00:03:36,710 --> 00:03:41,080 Power over ethernet plus is 802.3at. 92 92 00:03:41,080 --> 00:03:42,780 But I would write both of these down 93 93 00:03:42,780 --> 00:03:45,030 as part of your memorization guide. 94 94 00:03:45,030 --> 00:03:47,090 Now the idea of power over ethernet 95 95 00:03:47,090 --> 00:03:48,900 is that you can supply electrical power 96 96 00:03:48,900 --> 00:03:50,690 to devices over ethernet. 97 97 00:03:50,690 --> 00:03:52,580 That's the entire purpose of it. 98 98 00:03:52,580 --> 00:03:54,220 The benefit of this is that if I'm using 99 99 00:03:54,220 --> 00:03:56,030 a CAT five or higher cable, 100 100 00:03:56,030 --> 00:04:00,090 I only need a cable to give both power and data to something 101 101 00:04:00,090 --> 00:04:03,210 as opposed to having a power cable and a data cable. 102 102 00:04:03,210 --> 00:04:04,520 Now, each cable can provide you 103 103 00:04:04,520 --> 00:04:07,900 with up to 15.4 Watts of power to that device. 104 104 00:04:07,900 --> 00:04:10,630 With power over ethernet, plus this actually can go up 105 105 00:04:10,630 --> 00:04:13,000 to 25.5 Watts of power 106 106 00:04:13,000 --> 00:04:15,180 because it does support a higher wattage. 107 107 00:04:15,180 --> 00:04:17,570 Now, both of those numbers are things I would also add 108 108 00:04:17,570 --> 00:04:19,060 to your memorization sheet. 109 109 00:04:19,060 --> 00:04:22,360 So for power over ethernet, it's 15.4 Watts 110 110 00:04:22,360 --> 00:04:26,090 and power over ethernet plus, it's 25.5 Watts. 111 111 00:04:26,090 --> 00:04:27,970 There are two types of devices out there. 112 112 00:04:27,970 --> 00:04:31,200 We have power sourcing equipment and power devices. 113 113 00:04:31,200 --> 00:04:33,930 The power sourcing equipment or PSE, 114 114 00:04:33,930 --> 00:04:36,970 is what is going to provide the power to our other devices. 115 115 00:04:36,970 --> 00:04:38,910 This would normally be your switch. 116 116 00:04:38,910 --> 00:04:41,580 Now the power devices are things like your phone 117 117 00:04:41,580 --> 00:04:43,410 or a wireless access point. 118 118 00:04:43,410 --> 00:04:46,480 These are the devices that are getting power over ethernet 119 119 00:04:46,480 --> 00:04:48,910 and pulling it from our powered sourcing equipment, 120 120 00:04:48,910 --> 00:04:50,290 like our switches. 121 121 00:04:50,290 --> 00:04:53,630 Now all of this is going to occur over an RJ 45 connector 122 122 00:04:53,630 --> 00:04:56,520 using a CAT five or higher cable. 123 123 00:04:56,520 --> 00:04:58,280 Now the next one we have is what's known 124 124 00:04:58,280 --> 00:05:00,800 as port monitoring or port mirroring. 125 125 00:05:00,800 --> 00:05:02,690 This is not necessarily a number or a standard 126 126 00:05:02,690 --> 00:05:03,720 you have to memorize, 127 127 00:05:03,720 --> 00:05:06,430 but you do need to understand the concept of it. 128 128 00:05:06,430 --> 00:05:08,010 Now we talk about port monitoring, 129 129 00:05:08,010 --> 00:05:11,540 it's helpful to analyze packet flow over a network. 130 130 00:05:11,540 --> 00:05:13,770 Each switch port is its own collision domain 131 131 00:05:13,770 --> 00:05:15,700 as you remember from our last lesson, 132 132 00:05:15,700 --> 00:05:17,950 you can't listen from PC one to PC two 133 133 00:05:17,950 --> 00:05:20,310 if you're not PC one or PC two, 134 134 00:05:20,310 --> 00:05:21,143 because there's going to be 135 135 00:05:21,143 --> 00:05:23,070 that individual connection for them. 136 136 00:05:23,070 --> 00:05:25,587 Well, if you wanted to listen to that traffic 137 137 00:05:25,587 --> 00:05:27,470 because you need to do something for your security system, 138 138 00:05:27,470 --> 00:05:30,010 you have to connect a network sniffer to a hub, 139 139 00:05:30,010 --> 00:05:31,620 and then you'd be able to hear everything 140 140 00:05:31,620 --> 00:05:34,730 because hubs broadcast everything to every port, 141 141 00:05:34,730 --> 00:05:37,130 or you can do it in a switch by setting up 142 142 00:05:37,130 --> 00:05:39,520 a port monitoring or port mirroring. 143 143 00:05:39,520 --> 00:05:40,390 Now, what you do here 144 144 00:05:40,390 --> 00:05:42,590 is if you have a 24 port switch, for instance, 145 145 00:05:42,590 --> 00:05:46,010 and all your traffic is going from port one through port 23, 146 146 00:05:46,010 --> 00:05:48,920 you can then have it all mirrored out over port 24 147 147 00:05:48,920 --> 00:05:51,940 and attach your sensor there, your network analyst machine, 148 148 00:05:51,940 --> 00:05:54,400 and be able to collect that data and read it. 149 149 00:05:54,400 --> 00:05:56,490 Now for this to work, your switch requires 150 150 00:05:56,490 --> 00:05:58,380 that port mirroring or port monitoring 151 151 00:05:58,380 --> 00:06:00,670 is set up on the device and configured 152 152 00:06:00,670 --> 00:06:02,760 to allow all that traffic to be mirrored 153 153 00:06:02,760 --> 00:06:05,390 and copied over to that 24th port. 154 154 00:06:05,390 --> 00:06:06,530 In the case of this envelope 155 155 00:06:06,530 --> 00:06:08,960 that we want to send from PC one to PC two, 156 156 00:06:08,960 --> 00:06:11,720 we get a copy of that's made as it's sent over the network 157 157 00:06:11,720 --> 00:06:13,440 to the network analyst machine, 158 158 00:06:13,440 --> 00:06:16,460 as well as by the switch over through port mirroring, 159 159 00:06:16,460 --> 00:06:19,180 the port mirroring is going to make that copy and send it over 160 160 00:06:19,180 --> 00:06:20,920 so we can analyze it using something 161 161 00:06:20,920 --> 00:06:22,060 like a network analyst tool 162 162 00:06:22,060 --> 00:06:25,280 like Wireshark or some other network sensor. 163 163 00:06:25,280 --> 00:06:27,500 Next, we have user authentication 164 164 00:06:27,500 --> 00:06:31,310 and there is a number for this one, it's 802.1x. 165 165 00:06:31,310 --> 00:06:32,890 Now for security purposes, 166 166 00:06:32,890 --> 00:06:35,690 switches can require users to authenticate themself 167 167 00:06:35,690 --> 00:06:37,560 before they get access to the network. 168 168 00:06:37,560 --> 00:06:41,520 And 802.1x is going to allow us to do just that. 169 169 00:06:41,520 --> 00:06:43,390 Once you're authenticated, there's a key 170 170 00:06:43,390 --> 00:06:44,900 that's generated and it will be shared 171 171 00:06:44,900 --> 00:06:45,910 between the supplicant, 172 172 00:06:45,910 --> 00:06:47,910 which is the device wanting to access it 173 173 00:06:47,910 --> 00:06:50,950 like your laptop or your desktop and the switch itself, 174 174 00:06:50,950 --> 00:06:52,860 which we call the authenticator. 175 175 00:06:52,860 --> 00:06:54,930 So how this works is shown here on the screen, 176 176 00:06:54,930 --> 00:06:56,060 and you see the supplicant, 177 177 00:06:56,060 --> 00:06:58,990 which is PC one, is going to first talk to the switch. 178 178 00:06:58,990 --> 00:07:01,460 And it's going to ask for permission to join the network. 179 179 00:07:01,460 --> 00:07:03,150 That's when it's going to send it straight through 180 180 00:07:03,150 --> 00:07:04,730 to the authentication server 181 181 00:07:04,730 --> 00:07:06,460 and the authentication server is going to check 182 182 00:07:06,460 --> 00:07:07,820 the supplicant's credentials 183 183 00:07:07,820 --> 00:07:10,300 and create a key for it if it's authorized, 184 184 00:07:10,300 --> 00:07:12,650 then that key is used to encrypt traffic 185 185 00:07:12,650 --> 00:07:14,930 between the switch and the client. 186 186 00:07:14,930 --> 00:07:16,930 You can see here with the key distribution 187 187 00:07:16,930 --> 00:07:18,480 going from the authentication server 188 188 00:07:18,480 --> 00:07:21,020 to the authenticator, and then the key management 189 189 00:07:21,020 --> 00:07:24,400 goes from the authenticator to the switch, to the PC. 190 190 00:07:24,400 --> 00:07:28,070 At that point, both the switch and the PC have the same key, 191 191 00:07:28,070 --> 00:07:30,440 and we can create a symmetric encryption tunnel, 192 192 00:07:30,440 --> 00:07:32,200 which will secure all of our data. 193 193 00:07:32,200 --> 00:07:35,150 We will talk more about this process in a future lesson. 194 194 00:07:35,150 --> 00:07:37,997 As we dive into the security of 802.1x. 195 195 00:07:37,997 --> 00:07:41,410 Next, we have management access and authentication. 196 196 00:07:41,410 --> 00:07:43,180 To configure a manage our switches, 197 197 00:07:43,180 --> 00:07:45,050 you can do two different things. 198 198 00:07:45,050 --> 00:07:47,820 You can use SSH to do it and do it remotely. 199 199 00:07:47,820 --> 00:07:50,980 Or you can use a console port and do it locally. 200 200 00:07:50,980 --> 00:07:55,150 With SSH or Secure Shell, it's going to operate over port 22. 201 201 00:07:55,150 --> 00:07:57,240 And it's a remote administration program 202 202 00:07:57,240 --> 00:08:00,310 that allows you to connect to your switch over your network. 203 203 00:08:00,310 --> 00:08:01,700 Anywhere I'm sitting on the network, 204 204 00:08:01,700 --> 00:08:04,550 I can SSH into that switch and never have to get up 205 205 00:08:04,550 --> 00:08:07,820 from my desk, this way I can go and remotely manage it. 206 206 00:08:07,820 --> 00:08:09,820 Now, if I want to use a console port instead, 207 207 00:08:09,820 --> 00:08:12,320 I have to be there locally to plug into it. 208 208 00:08:12,320 --> 00:08:14,980 I would use an RS 232 serial cable, 209 209 00:08:14,980 --> 00:08:17,650 which we call a rollover cable, which has one end 210 210 00:08:17,650 --> 00:08:21,210 as an RJ 45 and the other end as a DB nine. 211 211 00:08:21,210 --> 00:08:23,680 And I'd be able to plug my laptop into the console port 212 212 00:08:23,680 --> 00:08:26,900 of a switch, and then when I'm physically connected to it, 213 213 00:08:26,900 --> 00:08:29,200 I can then go in and be able to access it 214 214 00:08:29,200 --> 00:08:31,870 and make different connections and configurations. 215 215 00:08:31,870 --> 00:08:33,560 Now, which one should you use? 216 216 00:08:33,560 --> 00:08:34,930 Well, this is going to depend 217 217 00:08:34,930 --> 00:08:36,980 on the security level of your network. 218 218 00:08:36,980 --> 00:08:39,320 It is more secure to do it locally 219 219 00:08:39,320 --> 00:08:42,070 than it is to do it through SSH over the network. 220 220 00:08:42,070 --> 00:08:43,420 But there's actually a third way 221 221 00:08:43,420 --> 00:08:44,990 that uses the benefits of both. 222 222 00:08:44,990 --> 00:08:48,130 And this is known as an out of band management network. 223 223 00:08:48,130 --> 00:08:50,350 Essentially, you create another network 224 224 00:08:50,350 --> 00:08:52,100 that sits on top of your network 225 225 00:08:52,100 --> 00:08:53,280 that you use for your data. 226 226 00:08:53,280 --> 00:08:55,330 And this network is only used to be able 227 227 00:08:55,330 --> 00:08:58,130 to connect to devices and configure them. 228 228 00:08:58,130 --> 00:09:00,130 Now you can do this out of band network 229 229 00:09:00,130 --> 00:09:01,920 by having a separate network configuration 230 230 00:09:01,920 --> 00:09:04,000 on this separate physical devices. 231 231 00:09:04,000 --> 00:09:06,930 And this way we might have a 24 port switch 232 232 00:09:06,930 --> 00:09:09,520 that connects to each of the other switches in our network. 233 233 00:09:09,520 --> 00:09:11,760 And that becomes our out of band network. 234 234 00:09:11,760 --> 00:09:13,940 We call it out of band because it is out 235 235 00:09:13,940 --> 00:09:16,540 of the normal band of where we send data. 236 236 00:09:16,540 --> 00:09:18,110 So we have this management network 237 237 00:09:18,110 --> 00:09:20,350 and then we have this data network. 238 238 00:09:20,350 --> 00:09:23,080 Now all of my management devices are on one network 239 239 00:09:23,080 --> 00:09:26,130 and all of my data transfer is on the other network. 240 240 00:09:26,130 --> 00:09:28,610 This way you have additional security to make sure 241 241 00:09:28,610 --> 00:09:31,920 all your configurations aren't touchable by the end users. 242 242 00:09:31,920 --> 00:09:33,850 And only by your system administrators 243 243 00:09:33,850 --> 00:09:36,730 who have permission to be on the out of band network. 244 244 00:09:36,730 --> 00:09:38,090 Now, the next thing we need to think about 245 245 00:09:38,090 --> 00:09:40,760 is this thing called first-hop redundancy. 246 246 00:09:40,760 --> 00:09:43,570 Now this has to do with layer three switches and routers. 247 247 00:09:43,570 --> 00:09:45,470 When we deal with first hop redundancy, 248 248 00:09:45,470 --> 00:09:47,990 we use protocols like HSRP, 249 249 00:09:47,990 --> 00:09:50,690 which is the hot standby router protocol. 250 250 00:09:50,690 --> 00:09:52,200 Essentially, it's going to create 251 251 00:09:52,200 --> 00:09:55,060 a virtual IP address and a virtual Mac address. 252 252 00:09:55,060 --> 00:09:58,240 And this curtain creates an active and a standby router. 253 253 00:09:58,240 --> 00:10:00,440 So in the case that you can see here on the screen, 254 254 00:10:00,440 --> 00:10:02,600 you'll see I have three routers displayed. 255 255 00:10:02,600 --> 00:10:05,240 I have an active router, which is the .one router. 256 256 00:10:05,240 --> 00:10:07,530 I have a standby rider, which is the .two. 257 257 00:10:07,530 --> 00:10:10,150 And I have a virtual router which is the .three. 258 258 00:10:10,150 --> 00:10:11,190 Now in the real world 259 259 00:10:11,190 --> 00:10:13,060 if I walk over to my networking cabinet, 260 260 00:10:13,060 --> 00:10:14,370 there's not three routers. 261 261 00:10:14,370 --> 00:10:16,450 There's only two physical routers standing there, 262 262 00:10:16,450 --> 00:10:18,150 the active and the standby, 263 263 00:10:18,150 --> 00:10:21,840 but my configured PC only sees one router. 264 264 00:10:21,840 --> 00:10:24,170 They see the virtual router, .three. 265 265 00:10:24,170 --> 00:10:25,940 So when my PC wants to communicate out, 266 266 00:10:25,940 --> 00:10:28,880 it communicates to the virtual router on .three. 267 267 00:10:28,880 --> 00:10:30,920 That way, it connects to the virtual router. 268 268 00:10:30,920 --> 00:10:32,670 And then the virtual router will know, 269 269 00:10:32,670 --> 00:10:34,320 based on which router's currently up, 270 270 00:10:34,320 --> 00:10:38,070 the active or standby, which one to send the traffic to. 271 271 00:10:38,070 --> 00:10:40,860 This is what the HSRP protocol does. 272 272 00:10:40,860 --> 00:10:43,760 We're going to go into much more depth on first hop redundancy 273 273 00:10:43,760 --> 00:10:46,640 later on when we get into the router section of this course. 274 274 00:10:46,640 --> 00:10:47,600 But for right now, 275 275 00:10:47,600 --> 00:10:49,480 I just wanted to introduce you to the idea, 276 276 00:10:49,480 --> 00:10:51,380 because if you're dealing with a layer three switch 277 277 00:10:51,380 --> 00:10:52,810 or a multi-layer switch, 278 278 00:10:52,810 --> 00:10:55,520 you might have to deal with first hop redundancy. 279 279 00:10:55,520 --> 00:10:56,570 Now, the other thing to know 280 280 00:10:56,570 --> 00:11:00,300 is that HSRB is not the only first hop redundancy protocol. 281 281 00:11:00,300 --> 00:11:02,770 There's also the gateway load balancing protocol, 282 282 00:11:02,770 --> 00:11:04,540 known as GLBP. 283 283 00:11:04,540 --> 00:11:08,450 There's also the virtual router redundancy protocol or VRRP. 284 284 00:11:08,450 --> 00:11:11,000 There's common address redundancy protocol or CARP, 285 285 00:11:11,900 --> 00:11:14,940 but HSRP, the hot standby routing protocol 286 286 00:11:14,940 --> 00:11:17,890 is the most popular that's used in most networks today. 287 287 00:11:17,890 --> 00:11:20,000 All of these work pretty much the same way. 288 288 00:11:20,000 --> 00:11:21,730 And for the exam, you just need to remember 289 289 00:11:21,730 --> 00:11:24,440 that they're all first hop redundancy protocols. 290 290 00:11:24,440 --> 00:11:25,810 When we get into routing later, 291 291 00:11:25,810 --> 00:11:28,020 we're going to talk more in depth about them and how they work, 292 292 00:11:28,020 --> 00:11:30,390 but for now, that's what you need to know. 293 293 00:11:30,390 --> 00:11:32,700 The next thing we want to talk about is MAC filtering, 294 294 00:11:32,700 --> 00:11:35,010 which is a layer two function, which again, 295 295 00:11:35,010 --> 00:11:37,470 we're dealing with switches, so that's really important. 296 296 00:11:37,470 --> 00:11:40,960 MAC filtering is the process of allowing or denying traffic 297 297 00:11:40,960 --> 00:11:43,070 based on a device's Mac address. 298 298 00:11:43,070 --> 00:11:45,350 And this can be used to help improve security. 299 299 00:11:45,350 --> 00:11:47,840 It's one of many layers of security we can add, 300 300 00:11:47,840 --> 00:11:50,370 but honestly, it's really not that strong of one, 301 301 00:11:50,370 --> 00:11:53,010 but it is one that we do need to talk about for the exam. 302 302 00:11:53,010 --> 00:11:55,010 Because according to the network plus exam, 303 303 00:11:55,010 --> 00:11:56,460 you should use it. 304 304 00:11:56,460 --> 00:11:58,530 Now, how does Mac filtering work? 305 305 00:11:58,530 --> 00:11:59,490 Well here on the screen, 306 306 00:11:59,490 --> 00:12:01,610 you'll see I have a wireless access point. 307 307 00:12:01,610 --> 00:12:04,290 We have a wired desktop, a wireless desktop 308 308 00:12:04,290 --> 00:12:05,940 and a wireless printer. 309 309 00:12:05,940 --> 00:12:08,220 If I wanted to make sure the only the wired desktop 310 310 00:12:08,220 --> 00:12:09,500 could talk to the printer, 311 311 00:12:09,500 --> 00:12:11,550 I can actually block the wireless desktop 312 312 00:12:11,550 --> 00:12:13,010 by its Mac address. 313 313 00:12:13,010 --> 00:12:15,930 We can tell the switch that if it comes from Mac address A, 314 314 00:12:15,930 --> 00:12:18,270 it's allowed, if it comes from Mac address B, 315 315 00:12:18,270 --> 00:12:20,120 you can block that traffic. 316 316 00:12:20,120 --> 00:12:21,770 Next, we have traffic filtering 317 317 00:12:21,770 --> 00:12:24,620 and traffic filtering is kind of like Mac filtering, 318 318 00:12:24,620 --> 00:12:27,480 except instead of doing it at the Mac address layer, 319 319 00:12:27,480 --> 00:12:29,340 we're going to do it at the logical layer 320 320 00:12:29,340 --> 00:12:31,640 using IP addresses or ports 321 321 00:12:31,640 --> 00:12:33,757 Now, this is where we start talking about things 322 322 00:12:33,757 --> 00:12:34,680 like layer three and layer four. 323 323 00:12:34,680 --> 00:12:36,500 And so we have to deal with this on a router 324 324 00:12:36,500 --> 00:12:38,500 or a multi-layer switch. 325 325 00:12:38,500 --> 00:12:40,430 So for example, if I have PC one, 326 326 00:12:40,430 --> 00:12:42,130 trying to talk to PC two, 327 327 00:12:42,130 --> 00:12:44,380 I can block it at the multi-layer switch. 328 328 00:12:44,380 --> 00:12:46,250 Seeing that anything coming from the address, 329 329 00:12:46,250 --> 00:12:50,530 192.168.1.100 is not allowed. 330 330 00:12:50,530 --> 00:12:53,070 I might put it on my blacklist and block it. 331 331 00:12:53,070 --> 00:12:57,680 Anything coming from 192.168.1.101 is allowed. 332 332 00:12:57,680 --> 00:13:00,170 And so it's on my white list and I'll add it in. 333 333 00:13:00,170 --> 00:13:01,820 Or I might do this based on ports. 334 334 00:13:01,820 --> 00:13:04,200 And I can say anything coming over port 25 335 335 00:13:04,200 --> 00:13:06,360 is allowed because there are mail servers, 336 336 00:13:06,360 --> 00:13:09,530 but anything coming from port 53 53 is not allowed. 337 337 00:13:09,530 --> 00:13:10,940 And I'm going to block them. 338 338 00:13:10,940 --> 00:13:13,120 This is the idea of traffic filtering. 339 339 00:13:13,120 --> 00:13:15,300 I can block it based on an IP address, 340 340 00:13:15,300 --> 00:13:17,370 or I can block it based off your port address. 341 341 00:13:17,370 --> 00:13:20,090 And that way, I can do it at layer three or layer four. 342 342 00:13:20,090 --> 00:13:21,340 If I want to do it at layer two, 343 343 00:13:21,340 --> 00:13:24,420 I use Mac address, layer three, IP addresses, 344 344 00:13:24,420 --> 00:13:26,330 layer four, ports. 345 345 00:13:26,330 --> 00:13:28,210 Either way I want to do it, it's okay. 346 346 00:13:28,210 --> 00:13:30,830 I can do this. Using an access control list, 347 347 00:13:30,830 --> 00:13:33,500 and we'll talk a lot more about access control lists 348 348 00:13:33,500 --> 00:13:34,650 when we talk about firewalls 349 349 00:13:34,650 --> 00:13:37,300 because that is exactly how they do things. 350 350 00:13:37,300 --> 00:13:40,010 Last, we want to talk about quality of service 351 351 00:13:40,010 --> 00:13:42,460 and quality of service is going to forward your traffic 352 352 00:13:42,460 --> 00:13:44,650 based on different priority markings. 353 353 00:13:44,650 --> 00:13:47,730 We have this switch, this multi-layer switch shown here, 354 354 00:13:47,730 --> 00:13:49,500 I have three devices that are connected to it. 355 355 00:13:49,500 --> 00:13:51,930 PC one, PC two, and a phone. 356 356 00:13:51,930 --> 00:13:55,040 Well, because phones are dealing with UDP voice traffic, 357 357 00:13:55,040 --> 00:13:57,230 I want to make sure it has a higher priority. 358 358 00:13:57,230 --> 00:13:59,840 So it gets first in, first out priority. 359 359 00:13:59,840 --> 00:14:01,920 Now, if I pick up the phone and I start talking, 360 360 00:14:01,920 --> 00:14:03,930 I want to make sure the packets are dropped 361 361 00:14:03,930 --> 00:14:06,910 so I don't have my voice going in and out as I'm talking. 362 362 00:14:06,910 --> 00:14:10,560 With PC1 and PC2, I can make those lower priorities 363 363 00:14:10,560 --> 00:14:12,380 and they'll get a lower level of service. 364 364 00:14:12,380 --> 00:14:14,840 And that's okay, because if they're using TCP, 365 365 00:14:14,840 --> 00:14:17,750 they'll just retransmit what's dropped and do it again. 366 366 00:14:17,750 --> 00:14:18,910 Now, in this example, 367 367 00:14:18,910 --> 00:14:22,470 you can see PC one has a higher priority than PC two, 368 368 00:14:22,470 --> 00:14:24,470 but the phone has a higher priority 369 369 00:14:24,470 --> 00:14:26,860 than both PC one and PC two. 370 370 00:14:26,860 --> 00:14:28,160 Now later on in the course, 371 371 00:14:28,160 --> 00:14:31,060 we're going to dive deep into the idea of quality of service. 372 372 00:14:31,060 --> 00:14:33,270 We'll spend a couple of videos on it in fact, 373 373 00:14:33,270 --> 00:14:35,960 because it's a really important concept, but for now, 374 374 00:14:35,960 --> 00:14:38,340 I just want you to understand that you can tell a switch 375 375 00:14:38,340 --> 00:14:40,400 or a router what is more important 376 376 00:14:40,400 --> 00:14:42,420 and what should get higher priority, 377 377 00:14:42,420 --> 00:14:44,780 which one is essentially the VIP. 378 378 00:14:44,780 --> 00:14:46,833 That's the idea of quality of service.