Computer Networking: SRWE Exam Review

Preparing for the Cisco CCNA 2: Switching, Routing, and Wireless Essentials (SRWE) exam can be a daunting task, but a thorough SRWE Exam Review is your key to success. This guide distills critical concepts from the SRWE course, focusing on essential topics in computer networking, from routing protocols and switching operations to wireless security and network troubleshooting. Whether you're a high school student or a university scholar, mastering these areas will not only help you pass your exam but also build a strong foundation for a career in networking. This SRWE Exam Review will cover key definitions, configurations, and troubleshooting scenarios that are frequently tested.

SRWE Exam Review: Routing Fundamentals

Routing is a cornerstone of computer networking, ensuring packets reach their intended destinations across different networks. Understanding various routing mechanisms, especially static routes and their configurations, is vital.

IPv6 Routing and Default Routes

For IPv6, a default route is represented by ::/0. This compressed form (0000:0000:0000:0000:0000:0000:0000:0000/0) is used when a router needs to forward a packet to a destination not explicitly listed in its routing table. For example, if router R1 receives a packet with a destination IPv6 address of 2001:db8:cafe:5::1, and its routing table contains a default route ::/0 pointing to GigabitEthernet0/0, the packet will be forwarded out that interface.

An IPv6 default static route is configured using the prefix ::/0, indicating that no bits need to match for the route to be used. For instance, ipv6 route ::/0 serial 0/1/1 would configure a default route out Serial 0/1/1.

Floating Static Routes for Redundancy

Floating static routes provide backup paths in case a primary route fails. They are configured with an administrative distance (AD) higher than the primary route. For an EIGRP route (AD of 90) to the 10.10.0.0/16 network, a floating static route like ip route 10.10.0.0 255.255.0.0 209.165.200.225 100 (where 100 > 90) would serve as a backup, using Branch1's serial interface IP as the next hop.

Configuring IPv4/IPv6 Static Routes

Correctly configuring static routes is essential. A common error is using an incorrect destination network or mask for a default route. For Internet access, the correct IPv4 default static route uses 0.0.0.0 0.0.0.0, for example, ip route 0.0.0.0 0.0.0.0 S0/0/0.

To forward IPv6 traffic to a LAN connected to another router, a fully specified static route might be needed. For instance, ipv6 route 2001:db8:12:10::/64 S0/0/0 fe80::2 ensures the router knows both the exit interface (S0/0/0) and the link-local next-hop address (fe80::2).

Advantages of Static Routes

Compared to dynamic routes, static routes offer several advantages:

• Improved Network Security: They don't exchange route updates with neighboring routers, making the network less susceptible to routing protocol attacks.
• Reduced Resource Usage: They consume fewer router resources, such as CPU cycles and bandwidth, because they don't need to calculate or communicate routes dynamically.

Troubleshooting Static Routes

When a static route is added, and a traceroute shows a wrong path or unreachable status, the immediate action should be to check the exit interface configuration of the new static route. Static routes, once configured, remain in the routing table even if the destination network no longer exists, requiring manual removal using the no ip route command.

Cisco Express Forwarding (CEF)

Cisco Express Forwarding (CEF) is a high-speed forwarding mechanism that uses a Forwarding Information Base (FIB) and an adjacency table to expedite packet routing. When CEF is disabled, multiaccess interfaces might require fully specified static routes to prevent routing inconsistencies, as the recursive lookup process is no longer optimized.

SRWE Exam Review: Switching Fundamentals

Layer 2 switches are critical for local area network (LAN) communication, learning MAC addresses and forwarding frames efficiently.

Frame Forwarding Decisions

Switches base forwarding decisions on MAC address and port mappings stored in the Content Addressable Memory (CAM) table. When a switch receives a frame:

• If the destination MAC address is in the CAM table and associated with a different port, the frame is forwarded out that specific port.
• If the destination MAC address is a broadcast or multicast, the frame is flooded out all ports except the incoming port.
• If the destination MAC address is a unicast address not in the CAM table, the frame is flooded out all ports except the incoming port (unknown unicast).
• Frames with a destination MAC address associated with the ingress port are not forwarded, as the destination is on the same segment.

MAC Address Table Dynamics

When a switch powers on, its MAC address table is empty. It learns MAC addresses by examining the source MAC address of incoming frames and associating them with the incoming port. If a source MAC address already exists in the table but on a different port, the switch updates the entry with the new port and refreshes the timer.

• Learning: Switch adds source MAC and incoming port to the table if not present.
• Flooding: For broadcasts, multicasts, or unknown unicasts, frames are sent out all ports except the ingress port.
• Forwarding: For known unicasts, frames are sent out the specific destination port.

Collision and Broadcast Domains

When multiple Cisco LAN switches are interconnected:

• Collision Domains: Each switch port typically represents a separate collision domain due to microsegmentation.
• Broadcast Domains: Interconnected switches form one large broadcast domain because switches do not filter broadcast frames, which are flooded to all ports. Connecting two or more switches increases the size of the broadcast domain and the number of collision domains.

Switch Characteristics for Congestion

Two switch characteristics that help alleviate network congestion are:

• Fast internal switching: Utilizes high-speed internal buses for quick data processing.
• Large frame buffers: Provides temporary storage for more received frames, preventing drops during traffic bursts or speed mismatches.

SRWE Exam Review: VLANs and Inter-VLAN Routing

VLANs (Virtual Local Area Networks) segment networks at Layer 2, improving organization and security. Inter-VLAN routing enables communication between these isolated VLANs.

VLAN Types

• Data VLANs: Carry user-generated traffic.
• Default VLAN: All switch ports are assigned to this VLAN (VLAN 1) after initial bootup.
• Native VLAN: Assigned to 802.1Q trunk ports and carries untagged traffic.
• Management VLAN: An IP address and subnet mask are assigned to this VLAN, allowing the switch to be accessed for management via HTTP, Telnet, SSH, or SNMP.

Trunking Protocols (DTP)

Dynamic Trunking Protocol (DTP) is a Cisco proprietary protocol that manages trunk negotiation between switches. It uses modes like dynamic desirable (initiates negotiation) and dynamic auto (responds passively). A functional trunk link can be established with pairs like dynamic desirable - trunk, dynamic desirable - dynamic desirable, or dynamic desirable - dynamic auto. If both ends are dynamic auto, they will form an access link. The switchport mode access command disables DTP and puts an interface into permanent nontrunking mode.

Inter-VLAN Routing (Router-on-a-Stick, Layer 3 Switch)

Router-on-a-Stick: This method uses a single router physical interface with multiple subinterfaces, each configured for a specific VLAN. The switch port connecting to the router must be configured as an 802.1Q trunk port. The encapsulation dot1Q [VLAN ID] command is crucial, where the VLAN ID identifies the specific VLAN traffic.

Layer 3 Switch: A multilayer switch can perform routing using Switched Virtual Interfaces (SVIs) or routed ports.

• Routed Ports: Physical ports that act like router interfaces (no switchport command). They are not associated with a particular VLAN and are often configured between switches at the core and distribution layers.
• SVI Configuration Steps: Create VLANs, assign ports to VLANs, create SVI interfaces (e.g., interface vlan 10), and enable IP routing globally (ip routing).

Troubleshooting VLANs

If inter-VLAN routing fails after a trunk link failure, and only specific VLANs have connectivity issues, the most likely cause is incorrect allowed VLANs on the backup trunk link. Also, remember that standard range VLANs (1-1005) are stored in the vlan.dat file in flash memory. Erasing startup-config does not remove them; vlan.dat must be manually deleted and the switch reloaded.

VLAN Trunking Protocol (VTP)

VTP synchronizes VLAN information across switches. Its modes are:

• Server: Can create, modify, and delete VLANs, and propagate this information.
• Client: Cannot create/modify/delete VLANs; receives updates from VTP servers.
• Transparent: Can create/modify/delete local VLANs but does not propagate or synchronize VTP information.

To add a new switch to an existing VTP domain as a client, configure the switch with the new domain name, the correct VTP mode (client), and connect it via a trunk link to receive updates. VTP requires switches to be in server or client mode to function.

SRWE Exam Review: Spanning Tree Protocol (STP) & Redundancy

Spanning Tree Protocol (STP) is crucial for preventing Layer 2 loops in redundant switched networks by disabling redundant paths.

STP Purpose and Operation

STP eliminates Layer 2 loops by blocking redundant links. When enabled on switches with redundant links (like EtherChannels), STP will block one of the redundant links. The show spanning-tree command displays STP status for all VLANs, including the root bridge BID and port roles.

RSTP Port Roles

Rapid PVST+ (RSTP) automatically determines link types (point-to-point, shared, edge) but they can be manually configured. Possible port roles in RSTP include:

• Root Port (RP): The port closest to the root bridge.
• Designated Port (DP): The port on a segment that sends the best BPDU towards the root bridge.
• Alternate Port (AP): A port that is blocked to prevent loops but can become a root port if the primary fails.

Given switches with default priority and same bandwidth, the switch with the lowest MAC address becomes the root bridge. All ports on the root bridge become designated ports.

Bridge ID Components

A Bridge ID (BID) is formed by combining three components:

• Bridge Priority
• Extended System ID
• MAC Address

STP Link Types and Convergence

STP and RSTP (IEEE 802.1D) assume only one spanning-tree instance for the entire network, potentially leading to suboptimal traffic flows. PVST+ and Rapid PVST+ create a separate instance per VLAN. MSTP maps multiple VLANs to the same instance for similar traffic flows.

PortFast: The spanning-tree portfast interface command allows a port connected to an end device to immediately transition to the forwarding state, bypassing listening and learning states. This prevents DHCP timeouts.

SRWE Exam Review: EtherChannel for Link Aggregation

EtherChannel bundles multiple physical Ethernet links into a single logical link, increasing bandwidth and providing redundancy without being blocked by STP.

EtherChannel Functionality

EtherChannel allows data to transmit over redundant switch links by making them appear as one logical connection. It can also perform load balancing across the bundled links using mechanisms like source IP to destination IP.

Configuration Modes (PAgP, LACP)

Cisco switches support two protocols for negotiating EtherChannels:

• PAgP (Port Aggregation Protocol - Cisco proprietary):
• on: Forces channeling without PAgP packets.
• desirable: Actively initiates negotiations.
• auto: Passively responds to negotiations.
• LACP (Link Aggregation Control Protocol - IEEE 802.3ad standard):
• on: Forces channeling without LACP packets.
• active: Actively initiates negotiations.
• passive: Passively responds to negotiations.

To bundle interfaces, use the interface range command (e.g., interface range GigabitEthernet 0/4 – 5) followed by channel-group [group-number] mode [mode]. The show etherchannel summary command is used to verify the EtherChannel status. A flag 'D' indicates the channel is down, 'S' indicates a Layer 2 channel, and 'L3' indicates a Layer 3 channel.

SRWE Exam Review: DHCP and IPv6 SLAAC

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and other network configuration parameters to devices. SLAAC (Stateless Address Autoconfiguration) provides similar functionality for IPv6.

DHCPv4 Configuration & Relay Agents

On a router, the ip helper-address [DHCP server IP] command configured on an interface indicates that the router is acting as a DHCPv4 relay agent. This allows the router to forward broadcast DHCPv4 requests from local clients as unicast packets to a DHCPv4 server on a different subnet. If PC1 is not receiving an IPv4 address, ensure the ip helper-address command is on the correct interface (the LAN containing the DHCPv4 client).

DHCPv6 Server & Stateless Autoconfiguration

When a router is configured as a DHCPv6 server and show ipv6 dhcp pool shows 0 active clients under stateless DHCPv6 (indicated by ipv6 nd other-config-flag), it means no clients have communicated with the server yet. Under stateless operation, the server doesn't maintain client IPv6 addresses as clients configure them by combining a prefix and a self-generated interface ID.

The ipv6 nd other-config-flag interface command allows Router Advertisement (RA) messages to indicate that additional information (like DNS servers) is available from a stateless DHCPv6 server.

IPv6 SLAAC

Stateless Address Autoconfiguration (SLAAC) relies on prefix information contained in RA messages to automatically create an IPv6 address. To enable a router to send RA messages for SLAAC, the ipv6 unicast-routing global configuration command must be used.

Before using an IPv6 address learned through SLAAC or DHCP, a host performs Duplicate Address Detection (DAD) by sending an ICMPv6 Neighbor Solicitation message. If no Neighbor Advertisement is returned, the address is considered unique.

For stateful DHCPv6, the ipv6 nd managed-config-flag command sets the M-flag in RA messages, instructing hosts to contact a stateful DHCPv6 server for their global unicast address.

SRWE Exam Review: First-Hop Redundancy Protocols (FHRP)

FHRPs provide default gateway redundancy, ensuring continuous network access even if a router fails.

Hot Standby Router Protocol (HSRP)

HSRP is a Cisco-proprietary FHRP that defines a group of routers, with one active and one standby. The virtual IP address and virtual MAC address for the HSRP group are crucial for hosts to gain connectivity. Hosts send ARP requests to the virtual IP, and HSRP routers reply with the virtual MAC. During a failover:

1. The forwarding router fails.
2. The standby router stops seeing hello messages from the forwarding router.
3. The standby router assumes the role of the forwarding router, using the virtual IP and MAC addresses.

SRWE Exam Review: LAN Security and Threat Mitigation

Network security is paramount. Understanding common LAN attacks and their mitigation techniques is essential for protecting network integrity.

MAC Address Table Overflow Attacks

Tools like macof are used to flood LAN switches with MAC addresses, aiming to exhaust the MAC address table. When the table overflows, the switch behaves like a hub, flooding all subsequent incoming frames to all ports within the VLAN. This allows an attacker to intercept traffic destined for other hosts. Mitigation strategies include:

• Port Security: Restricts the number of allowed MAC addresses on a port. switchport port-security enables it on an interface. sticky secure MAC addresses dynamically learns and saves MAC addresses to the running configuration. Violation modes include restrict (drops packets, sends notification), protect (drops packets, no notification), and shutdown (interface error-disabled).

VLAN Hopping Attacks

VLAN hopping allows traffic from one VLAN to be seen by another without a router. Methods include:

• DTP Spoofing: An attacker configures a host or rogue switch to spoof Dynamic Trunking Protocol (DTP) signaling, exploiting switch ports with automatic trunking enabled to establish an unauthorized trunk link.
• Double-Tagging: An attacker connected to a port in the same VLAN as the native VLAN of a trunk port sends a frame with two 802.1Q tags. The first switch strips the outer (native VLAN) tag, leaving the hidden inner tag to be processed by the second switch, allowing access to another VLAN.

Mitigation techniques for VLAN attacks:

• Disable DTP: Use switchport mode access for access ports and switchport nonegotiate for trunk ports to manually control trunking.
• Set Native VLAN to Unused VLAN: Ensure user access ports are in VLANs distinct from trunk link native VLANs.
• Manually Enable Trunking: Configure trunk links explicitly instead of relying on DTP.
• Use Private VLANs: Isolate ports within a VLAN.

DHCP Spoofing and Starvation Attacks

• DHCP Spoofing: Rogue servers provide false IP configuration parameters to clients.
• DHCP Starvation: An attacker floods the DHCP server with requests to exhaust the IP address pool, leading to a Denial of Service (DoS).

Mitigation:

• DHCP Snooping: Globally enabled with ip dhcp snooping, then ip dhcp snooping vlan [VLAN ID] for specific VLANs. It builds a binding database of valid MAC-to-IP address mappings from DHCP exchanges. Untrusted interfaces can be rate-limited (ip dhcp snooping limit rate 6) to prevent starvation attacks.

ARP Spoofing and Poisoning Attacks

These attacks involve an attacker sending spoofed ARP messages to link their MAC address with the IP address of another legitimate device on the network.

• Dynamic ARP Inspection (DAI): ip arp inspection vlan [VLAN ID] enables DAI for specified VLANs. DAI intercepts ARP packets on untrusted ports and validates them against the DHCP snooping binding table. It relies on DHCP snooping to build its binding database. The ip arp inspection validate src-mac command checks if the source MAC in the Ethernet header matches the sender MAC in the ARP body.

Other Security Best Practices

• Disable Unused Ports: Use the shutdown command to administratively disable switch ports.
• BPDU Guard: Enable on all PortFast-enabled end-user ports to immediately error-disable a port if a BPDU is received, preventing rogue switches. Global command: spanning-tree portfast bpduguard default.
• Root Guard: Prevents a switch from becoming the root switch.
• Loop Guard: Detects unidirectional links to prevent alternate or root ports from becoming designated ports.
• Secure Remote Access: Configure SSH (Secure Shell) instead of Telnet for encrypted management connections.
• AAA (Authentication, Authorization, Accounting): Server-based AAA (using RADIUS or TACACS+) provides centralized authentication, authorization, and accounting. Authorization is implemented immediately after successful authentication.

SRWE Exam Review: Wireless Networking Fundamentals

Wireless networks offer flexibility but require careful configuration for performance and security.

Wi-Fi Standards and Frequencies

• 2.4GHz Band: 802.11b, 802.11g, and 802.11n (can also operate in 5GHz). Non-overlapping channels in North America are 1, 6, and 11.
• 5GHz Band: 802.11a, 802.11n (can also operate in 2.4GHz), and 802.11ac. The 5GHz band has more channels and is generally less crowded, making it better for high-bandwidth, time-sensitive applications like streaming multimedia.

Wireless Security Methods

• WPA2 (Wi-Fi Protected Access 2): Currently considered the strongest encryption. Uses Advanced Encryption Standard (AES) for encryption, providing privacy and integrity. WPA2 comes in two primary authentication modes:
• Personal (WPA2-PSK): Uses a pre-shared key, ideal for home/small office.
• Enterprise (WPA2-Enterprise): Requires an external RADIUS server for 802.1X authentication, providing centralized user authentication.
• WPA (Wi-Fi Protected Access): Uses TKIP, stronger than WEP but not as strong as WPA2.
• WEP (Wired Equivalent Privacy): Obsolete and insecure.

Wireless LAN Controllers (WLCs)

WLCs centralize management of multiple Lightweight Access Points (LAPs) and WLANs, especially in large enterprise environments. They use protocols like CAPWAP for communication. Key functions of a WLC in a split MAC architecture include association and re-association of roaming clients, and frame translation to other protocols. The CONTROLLER tab on a Cisco WLC is used to create new VLAN interfaces.

Wireless Router Settings and Security

SOHO wireless routers combine switch, access point, and router functionalities. Default settings can pose security risks:

• Broadcasting SSID: Disabling SSID broadcast (cloaking) hides the network from casual scanners, but it doesn't offer strong security against determined attackers.
• Default Administrator Password: Always change this.
• Default DHCP IPv4 Addresses: Changing the default IP range makes it harder for outsiders to map the network.
• Passive Mode (AP): When an access point is configured in passive mode, the SSID is broadcast.
• Active Mode (AP): When configured in active mode, clients must know the SSID to connect.

SNMP (Simple Network Management Protocol)

Network devices can generate log messages, known as traps, that are sent to an SNMP server. These traps contain status reports or urgent conditions.

Frequently Asked Questions (FAQ)

What is a floating static route and why is it used in SRWE?

A floating static route is a backup route that only becomes active if the primary route fails. It is configured with an administrative distance (AD) higher than the primary route. For example, if your primary route is learned via EIGRP (AD 90), you'd set the floating static route's AD to something higher, like 100 or 120. This ensures the router prefers the primary route when available, but has a fallback path if the main link goes down. It's a key concept for ensuring network redundancy and reliability.

How do switches learn MAC addresses and why is this important for SRWE?

Switches learn MAC addresses by examining the source MAC address of incoming frames and associating them with the port where the frame entered. This information is stored in the MAC address table (CAM table). This process is crucial because it allows the switch to make intelligent forwarding decisions. Instead of flooding all frames, it can send unicast frames directly to the correct destination port, improving network efficiency and performance. Understanding this learning process is fundamental to understanding Layer 2 switching operations.

What are VLAN hopping attacks and how can they be mitigated?

VLAN hopping attacks allow unauthorized access to different VLANs by bypassing normal routing. One common method is Dynamic Trunking Protocol (DTP) spoofing, where an attacker tricks a switch port into becoming a trunk port. Another is double-tagging. To mitigate these, you should disable DTP on all access ports (switchport mode access) and explicitly configure trunk ports (switchport mode trunk with switchport nonegotiate). Additionally, it's best practice to set the native VLAN on trunk links to an unused VLAN ID that is distinct from any user access VLANs. These security measures prevent attackers from gaining unauthorized access to sensitive network segments.

Why is DHCP snooping important for network security in SRWE?

DHCP snooping is vital for network security because it helps prevent DHCP spoofing and starvation attacks. It works by intercepting DHCP messages on untrusted ports and building a binding database of valid IP-to-MAC address associations. This database is then used by other security features like Dynamic ARP Inspection (DAI) to validate ARP packets. Globally enabling DHCP snooping and configuring trusted interfaces (e.g., ports connected to legitimate DHCP servers) ensures that only valid DHCP traffic is processed, protecting your network from rogue DHCP servers and denial-of-service attacks.

What are the main differences between 2.4GHz and 5GHz Wi-Fi bands?

The 2.4GHz and 5GHz Wi-Fi bands offer different characteristics for wireless networking. The 2.4GHz band (used by 802.11b/g/n) provides a wider range and better penetration through obstacles, but it is more susceptible to interference from other devices (like microwaves or Bluetooth) and has fewer non-overlapping channels. The 5GHz band (used by 802.11a/n/ac) offers higher speeds, more available channels, and less interference, making it ideal for high-bandwidth applications like video streaming. However, it has a shorter range and is more easily obstructed. Understanding these differences helps in designing efficient and reliable wireless networks, especially for split-the-traffic approaches.