Speaker 1: Welcome back to the Deep Dive. Today, we're embarking on
Speaker 1: a really fascinating journey. We're going to peel back the
Speaker 1: layers of Cisco networking commands.
Speaker 2: Yeah, getting into the nitty gritty exactly.
Speaker 1: If you've ever felt, you know, maybe a bit overwhelmed
Speaker 1: by network complexity, or just wondered how these little boxes
Speaker 1: make the Internet work, then you're definitely in the right place.
Speaker 1: We'll navigate the essentials from just setting things up to
Speaker 1: well some pretty advanced stuff like enterprise routing.
Speaker 2: Get ready to understand the language.
Speaker 1: Right, you got it, the language of networks.
Speaker 2: And this deep dive it's built straight from Ramonenstas's Cisco
Speaker 2: CCNA Command Guide. It's a fantastic resource, really geared towards
Speaker 2: helping people nail The CCNA.
Speaker 1: Exam covers a lot, doesn't it.
Speaker 2: Oh Yeah, routing, switching commands, subnetting, VLSM, CIDR, the works.
Speaker 2: But our mission today for you listening isn't just about
Speaker 2: memorizing commands.
Speaker 1: No, it's deeper than that, exactly.
Speaker 2: It's about getting the why how you manage, configure, and
Speaker 2: troubleshoot these Cisco devices quickly effectively. The guide keeps it simple,
Speaker 2: which really helps you learn Cisco iOS properly.
Speaker 1: Okay, let's unpack this. Then you get a brand new
Speaker 1: Cisco device, plug it in. It's just sitting there. How
Speaker 1: do you even like talk to it? What's step one?
Speaker 2: Right, the very first step. It all starts with the
Speaker 2: command line interface, the CLI. Think of it as, you know,
Speaker 2: a direct conversation with a device's brain. When you first connect,
Speaker 2: you land in what's called user exec mode. You'll see
Speaker 2: a little.
Speaker 1: Prompt like the front door.
Speaker 2: Pretty much from there, you type enable. That gets you
Speaker 2: into privileged mode, and the prompt changes to a hashtag.
Speaker 2: Now you can see more, do a.
Speaker 1: Bit more, but not change things yet.
Speaker 2: Not configuration changes. No, for that the real work. You
Speaker 2: type configure terminal or confitive T for short usually H
Speaker 2: a shortcut. Yeah, everyone uses the shortcuts. That takes you
Speaker 2: into global configuration mode. The prompt changes again to config hashtag.
Speaker 2: Each mode kind of unlocks more power.
Speaker 1: So once we're past that initial handshake into the configure modes,
Speaker 1: how do we give this box an actual name? Make
Speaker 1: it identifiable on the network?
Speaker 2: Good question. Giving it an identity is well fundamental. You
Speaker 2: start with the host name. Simple command host name R one,
Speaker 2: for instance, makes it unique R one. Okay, then you
Speaker 2: gotta light up its connections right the interfaces. You go
Speaker 2: into a specific interface with say interface gigabyte eternet serce.
Speaker 1: So you target the specific port exactly.
Speaker 2: Once you're inside that interface, can figure you give it
Speaker 2: an IP address and subnetmask like eep address one ninety
Speaker 2: two point one sixty eight one point one two five
Speaker 2: five point two five to five point two five.
Speaker 1: Five point zero. Standard stuff, standard stuff.
Speaker 2: But here's the kicker, the thing everyone trips over it first.
Speaker 2: By default, interfaces are off administratively.
Speaker 1: Down, so it won't work yet.
Speaker 2: Nope, you must use the no shut down command that
Speaker 2: actually activates the interface, turns it on. Without that, your
Speaker 2: IP address is just sitting there.
Speaker 1: Doing nothing, like a light switch, basically.
Speaker 2: Exactly like a light switch. The guide shows a good
Speaker 2: example for R two right configure one interface it dress
Speaker 2: one ninety two point one sixty eight point one one
Speaker 2: two five five point two, five five point zero. Then
Speaker 2: maybe gigabyte e fin at zero one with each breast
Speaker 2: seventy seven point two two point one point one. Both
Speaker 2: need that no shutdown crucial.
Speaker 1: Got it, no shutdown? Bring that one into memory. Okay,
Speaker 1: building on that, what about security? Right from the start
Speaker 1: we hear about enable password and enable secret. What's the deal?
Speaker 1: There is one better? Oh?
Speaker 2: Absolutely one is better. It's all about how protected your
Speaker 2: access is. Enable passwords. That's a password, sure, but it's
Speaker 2: stored in plaintext.
Speaker 1: Plaintext.
Speaker 2: Yikes, yeah, big yikes. If someone sees your config file,
Speaker 2: they see the password. Enable secret, though that uses strong
Speaker 2: encryption a hash it's unreadable. Always always use enable secret
Speaker 2: for protecting privilege mode.
Speaker 1: So secret is the way to go. What about passwords?
Speaker 1: Already there?
Speaker 2: Good point their service password encryption. Run that and it'll
Speaker 2: encrypt any existing plaintext passwords in the running config. It's
Speaker 2: not super strong encryption, mind you, but it's better than
Speaker 2: nothing for things like user passwords.
Speaker 1: Okay, and what about those warning messages you see log.
Speaker 2: In ah, the banner mod message of the day. That's
Speaker 2: your digital keepout sign. You set it with banner mod
Speaker 2: hashtag and then type your message, ending with another hashtag,
Speaker 2: usually something like unauthorized access denied. It's a legal thing,
Speaker 2: mostly a deterrent exactly. And the guide also mentions IP
Speaker 2: domain name and IP domain look up quick ones, but important.
Speaker 2: They let your router resolve names like Google dot Com
Speaker 2: to IP addresses, turns on DNS lookup.
Speaker 1: Basically so it understands names, not just numbers. Yeah, makes sense. Okay,
Speaker 1: we've got basic setups of initial security. How do we
Speaker 1: manage these things remotely? Telnet versus SSH comes up all
Speaker 1: the time? Is telnet ever? Okay?
Speaker 2: Honestly almost never these days. It really comes down to security,
Speaker 2: and SSH wins hands down.
Speaker 1: Why is that?
Speaker 2: Telment configuration is simple? Yeah, h line VT zero four,
Speaker 2: set of password, Cisco log in done. But the massive
Speaker 2: flaw is it sends everything usernames, passwords, commands in clear text.
Speaker 1: Like shouting your password across the office exactly.
Speaker 2: Anyone listening on the network can grab it. S secure
Speaker 2: shell encrypts the entire session much safer.
Speaker 1: So how do you set up SSH? Then? More involved
Speaker 1: a bit more.
Speaker 2: Yeah, you need to create a username with a password first,
Speaker 2: set that IP domain name we mentioned, Then generate encryption keys,
Speaker 2: crypto key, generate URSA modulus one to eighty four is
Speaker 2: a common one. You should probably use ipsetch version two
Speaker 2: for better security. Then on your vty lines line VLO four.
Speaker 2: Instead of just log in, you use log in local
Speaker 2: to check against the local username database. And the key
Speaker 2: part is transport input stish that tells it only allow
Speaker 2: SSH connections on these lines.
Speaker 1: No telnet locks it down. What about plugging directly in
Speaker 1: the console port?
Speaker 2: Good point local access that's line console zero. You'd set
Speaker 2: a password and log in there too. A really useful
Speaker 2: command for the console is logging synchronous stops log messages
Speaker 2: from messing up your typing midcommands.
Speaker 1: Oh that's andy, I hate that everyone does.
Speaker 2: And maybe set an exec time out five so it
Speaker 2: logs out idle sessions after five minutes. Basic security hygiene.
Speaker 1: It sounds like a fair few commands to get right
Speaker 1: after typing all that in. How do we double check
Speaker 1: make sure it actually worked or figure out what's wrong
Speaker 1: if it did.
Speaker 2: Verification is key, absolutely key. Cisco iOS gives you a
Speaker 2: bunch of show commands. They're your best friends. Like what
Speaker 2: show running config is. The big one shows you the
Speaker 2: entire active configuration, what the router is actually using right now,
Speaker 2: Live blueprint exactly. For a quick check of interfaces IPS
Speaker 2: and whether they're up or down show IP an interface
Speaker 2: brief is gold super useful.
Speaker 1: Okay, BRIEFE is good if you need.
Speaker 2: All the details about an interface, errors, speed, duplex, all
Speaker 2: that the's avermeter. Then it's show interfaces more verbose. Gotcha
Speaker 2: to see the router's map of the network, how it
Speaker 2: knows where to send stuff. That's show ip root shows
Speaker 2: the routing table makes sense. And if you just want
Speaker 2: to see who's logged in right now, show users. These
Speaker 2: commands are how you see what's going on inside. Essential
Speaker 2: for checking your work and troubleshooting.
Speaker 1: Okay, here's where it gets really interesting for me. We've
Speaker 1: got devices talking, sure, but in any decent sized network,
Speaker 1: just having everyone yelling in the same big room digitally
Speaker 1: speaking gets chaotic fast.
Speaker 2: Oh yeah, broadcast storms security issues.
Speaker 1: Right, so we need to create smaller neighborhoods. Yes, logical divisions.
Speaker 1: That brings us to vlands right right? Where are they? Fundamentally?
Speaker 2: Fundamentally, vlan's virtual lands are a way to take one
Speaker 2: physical switch and chop it up into multiple virtual switches,
Speaker 2: so devices connected to the same physical box can be
Speaker 2: completely separated as if they were on different hardware.
Speaker 1: So HR doesn't see engineering's traffic even if they're plugged
Speaker 1: into the same switch.
Speaker 2: Precisely, the rule is one VLAN equals one network equals
Speaker 2: one broadcast domain. That last part is huge broadcasts which
Speaker 2: can flood a network stay within their.
Speaker 1: Own VLAN ah, So it cuts down noise and improves.
Speaker 2: Performances massively, plus huge benefits for security. Logical isolation is powerful,
Speaker 2: better network design. You can group users or functions logically
Speaker 2: and scalability. Much easier to add a new department or
Speaker 2: function as a new vland than rewire.
Speaker 1: Everything sounds super powerful. Now. Switches have these two special
Speaker 1: port types for VLANs, access and trunk. What's the difference?
Speaker 1: How do they work?
Speaker 2: That's the core distinction. Yeah, and access port belongs to
Speaker 2: one VLAN only. It's for connecting end devices, your PC,
Speaker 2: your laptop, a server. Think of it as a driveway
Speaker 2: to a single house.
Speaker 1: Okay, one VLAN per access port right.
Speaker 2: A trunk port, on the other hand, is designed to
Speaker 2: carry traffic for multiple vlands at the same time. It's
Speaker 2: the highway connecting different neighborhoods or buildings. Use trunks to
Speaker 2: connect switches together or a switch to a router that
Speaker 2: needs to understand VLANs.
Speaker 1: Gotcha highway versus driveway? How do you configure them?
Speaker 2: For an access port? It's usually switchport mode Access and
Speaker 2: then switchport access of land ten to assign it to
Speaker 2: VLAN ten. For example, for a trunk, you'd typically set
Speaker 2: the encapsulation first, usually switchport trunk encapsulation DOT one QUE
Speaker 2: that's the standard tagging method. Then switchport mode trunk and
Speaker 2: often you specify which VLANs are allowed switchport trunk allowed
Speaker 2: land ten, thumb and twenty and.
Speaker 1: You verify this how Chauvelin.
Speaker 2: Brief gives you a nice table of your VLANs and
Speaker 2: which ports are in them. Show interfaces trunk shows you
Speaker 2: the status of your trunk ports, which vlands are allowed,
Speaker 2: and which is the native vilan.
Speaker 1: What about locking down those individual ports? Seems like some
Speaker 1: could just walk up, plug in a laptop and get
Speaker 1: onto the network if we're not careful.
Speaker 2: Ah, good point. That's where port security comes in. It's
Speaker 2: like having a bouncer on each switch.
Speaker 1: Port, okay, checking IDs sort of.
Speaker 2: It checks the m messy address of the device plugging in.
Speaker 2: You enable it with port security, Then you decide what
Speaker 2: happens if an unauthorized device connects the violation mode.
Speaker 1: What are the options?
Speaker 2: Shut Down is the most common. It just disables the port,
Speaker 2: needs an admin to re enable it. Restrict drops the
Speaker 2: bad traffic, but keeps the port up and logs the violation.
Speaker 2: Protect is similar, but doesn't even.
Speaker 1: Log it shut down seems safest often is.
Speaker 2: You also control how it learns the allowed EMCY addresses.
Speaker 2: Sticky tells the switch to learn the first MC address
Speaker 2: it sees and stick it to the config. Or you
Speaker 2: can manually define static MD addresses, and you can set
Speaker 2: a maximum number of allowed max purport often just one
Speaker 2: for user ports.
Speaker 1: So switch port security maximum one logs it down tight.
Speaker 2: Exactly prevents simple plug in attacks.
Speaker 1: Okay, so we've neatly separated our networks with VLANs. We've
Speaker 1: secured the ports. But wait, now, HR can't talk to
Speaker 1: engineering at all. That's maybe too much separation, right, How
Speaker 1: do they communicate when needed?
Speaker 2: That's the next logical problem. Switches operate at layer two.
Speaker 2: They forward frames within a v LAN. They won't route
Speaker 2: packets between vlands or networks. For that, you need a
Speaker 2: layer three device, a router.
Speaker 1: Okay, so we need a router involved yep.
Speaker 2: And a very common, slightly older but still widely used
Speaker 2: technique is called router on.
Speaker 1: A stick or a row rider on a stick. Sounds funny,
Speaker 1: it does.
Speaker 2: But it describes it. Well, yeah, you take one physical
Speaker 2: router interface, connect it to your switch, and configure that
Speaker 2: switch port as a trunk carrying all the v lands.
Speaker 1: Ah, so the router sees all the vland traffic on
Speaker 1: that one link precisely.
Speaker 2: Then on the router side, you create virtual sub interfaces,
Speaker 2: one for each VLAN you need to rout between, like
Speaker 2: interface gigabyte ethernet zero zero point zero for VLAN.
Speaker 1: Ten got ten ten. Okay.
Speaker 2: Inside that sub interface, you tell it which VLAN it's
Speaker 2: four using encapsulation dot one Q ten and give it
Speaker 2: an IP address like EP address one ninety two point
Speaker 2: one sixty eight point zero point one two FY five
Speaker 2: point two FI five point two five five point zero.
Speaker 2: That IP becomes the defunct gateway for devices in VLAN
Speaker 2: ten whatever.
Speaker 1: So the router handles the traffic between the sub interfaces exactly.
Speaker 2: It routes between VLAN tens network and say VLAN twenty's
Speaker 2: network via its sub interfaces. It's cost effective because you
Speaker 2: only need one router port, which is why it's still
Speaker 2: around even in big companies.
Speaker 1: Sometimes, what's the catch that that's too easy?
Speaker 2: The catch is that all intervaland traffic has to go
Speaker 2: up the stick to the router and back down again.
Speaker 2: That single link can become a bottleneck, especially if you
Speaker 2: have heavy traffic between vlands. That's why using a one
Speaker 2: gbps or faster interface on the router is pretty much essential.
Speaker 1: Makes sense avoid the time traffic jam on the stick. Hmm, okay,
Speaker 1: let's shift gears to routing itself. A router fresh out
Speaker 1: of the box only knows about networks it's directly plugged
Speaker 1: into right its.
Speaker 2: Own little world spot on it's routing tables pretty empty initially,
Speaker 2: just the networks on its active interfaces.
Speaker 1: So how do we teach it about the rest of
Speaker 1: the world, other networks it needs to reach? Yeah, this
Speaker 1: gets us into static versus dynamic routing.
Speaker 2: Yeah, exactly two main ways to build that network map.
Speaker 2: Static roots are where you the administrator manually tell the
Speaker 2: router exactly how to reach every single remote network.
Speaker 1: How does that look?
Speaker 2: The command is ip rot, then the destination network the mask,
Speaker 2: and finally the next top IP address the IP of
Speaker 2: the next router in line that knows how to get there.
Speaker 1: So very explicit. Hip route ten point zero point zero
Speaker 1: two five five point two five five point two five
Speaker 1: five point two five five point zero one ninety two
Speaker 1: point one six eight point one point two something like that.
Speaker 2: Perfect example. It's precise low overhead on the router, But
Speaker 2: imagine doing that for hundreds of networks. It gets unmanageable.
Speaker 1: Fast, right mare? What about your getting to the internet?
Speaker 2: AH. For that, you use a static default route EP
Speaker 2: root zero point zero point zero point zero point zero
Speaker 2: point zero, followed by the next hop IP usually your
Speaker 2: ISP's router.
Speaker 1: Zero zero zero zero, meaning any network I don't already.
Speaker 2: Know about exactly. It's the root of last resort. If
Speaker 2: the router has no specific match in its table, it
Speaker 2: sends the packet out via the default route essential for
Speaker 2: Internet access.
Speaker 1: Okay, Static routes are good for small, predictable setups or
Speaker 1: default routes, but for bigger, changing networks that manual of
Speaker 1: coaches out. That's where dynamic routing comes in, right yeah,
Speaker 1: Routers talking.
Speaker 2: To each other precisely. Dynamic routing protocols allow routers to
Speaker 2: automatically learn about remote networks from their neighbors. They share
Speaker 2: information and build their routing tables collaboratively.
Speaker 1: Let's start with an older, simpler one RIPv two. What's
Speaker 1: its deal?
Speaker 2: RIPv two Routing Information Protocol version two. It's simple because
Speaker 2: it's metric. How it decides the best path is just
Speaker 2: the hop count. How many routers away is the destination?
Speaker 2: Fewer hops is better?
Speaker 1: Sound straightforward? Can figure youuration easy.
Speaker 2: Pretty easy. You go into router RIP mode tell it
Speaker 2: version two critically, use no auto summary that prevents some
Speaker 2: old problematic behaviors. Then you use network commands to tell
Speaker 2: RIP which of your directly connected networks it should advertise
Speaker 2: to neighbors.
Speaker 1: So network one ninety two point one sixty eight point
Speaker 1: one point.
Speaker 2: Zero exactly, and optionally default information originate. If you want
Speaker 2: this RIP router to advertise a default route, it knows about.
Speaker 1: Okay, simple hopcount. Now what's fascinating here is how does
Speaker 1: this apply to IPv six, the next generation ip is
Speaker 1: it totally different?
Speaker 2: The core ideas are similar, but the commands change naturally.
Speaker 2: First big thing for IPv six routing you must enable
Speaker 2: it globally with IPv six unicast routing. Without that, nothing happens.
Speaker 1: Okay, master switch for IPv six routing.
Speaker 2: YEP Assigning an IPv six address is IPv six address
Speaker 2: of TBCD dot ABCD dot one two five four point
Speaker 2: one sixty four for example, static routes very similar pattern
Speaker 2: IV six route destination, network prefix, next stop.
Speaker 1: IPv six makes sense. And the dynamic protocol is there
Speaker 1: an IPv six RIP there is.
Speaker 2: It's called RIP and RIP next generation. You can figure
Speaker 2: it with IPv six router rip name. You give it
Speaker 2: a name, then you enable it on the interfaces you
Speaker 2: want it to run on using IPv six RIP me
Speaker 2: name enable. So similar logic, different commands got it.
Speaker 1: Moving up the latter to more serious scalable protocols OSPF.
Speaker 1: You hear this one all the time, the workhorse, Right,
Speaker 1: Why is it so popular?
Speaker 2: OSPF Open shortest Path? First, it's huge, probably the most
Speaker 2: widely deployed internal routing protocol. Big reason. It's an open standard,
Speaker 2: vendor independent, works on Cisco, Juniper or whatever, unlike some others.
Speaker 2: Unlike some others. Yes, and it's a link state protocol.
Speaker 2: That means every OSPF router build a complete map a
Speaker 2: topology database of the entire network area.
Speaker 1: It's in, so it knows the whole layout it does.
Speaker 2: Then it runs Dikstra's algorithm clever math to taculate the
Speaker 2: absolute shortest path to every destination based on cost which
Speaker 2: is usually calculated from interface bandwidth. Faster links have lower costs,
Speaker 2: so they're preferred.
Speaker 1: Smart How do you set it up?
Speaker 2: Two main ways. The older way is router ASP process ID,
Speaker 2: then using network commands with a wildcard mask and specifying
Speaker 2: the area like network one nine to two point one
Speaker 2: six eight point one point zero point zero point two
Speaker 2: five five Area zero.
Speaker 1: The wild card mask the inverse of a subnetmask exactly.
Speaker 2: The newer, often easier way is just to go into
Speaker 2: the INFHASE configuration and type ip AS process ID. Areas
Speaker 2: zero enables OSPF directly on that link.
Speaker 1: Seems simpler. You mentioned area yeah.
Speaker 2: OSPF uses areas to break up large networks, improve scalability
Speaker 2: and control routing updates. Area zero is the backbone. You
Speaker 2: can have other areas like STDU areas, totally SSDUB areas, NSSA,
Speaker 2: different types to optimize things. Gets complex but powerful.
Speaker 1: Okay. Next step EI g RP OSBF Cisco only cousin.
Speaker 1: You could say you called it hybrid earlier. What's that mean?
Speaker 2: EI g RP Enhanced Interior Gateway Routing Protocol. Yes, key
Speaker 2: thing Cisco Proprietary only runs on Cisco gear. That's its
Speaker 2: biggest drawback in mixed environments, so why it's very fast
Speaker 2: to CONVERGEIU link fails often faster than OSPF initially, and
Speaker 2: it's called hybrid or sometimes advanced distance vector because it
Speaker 2: borrows cool features from both link state and distance vector worlds.
Speaker 2: Like what from link state, it uses Hello packets to
Speaker 2: find neighbors quickly, maintains neighbor and topology tables, and sends
Speaker 2: updates reliably. But like distance vector, it primarily relies on
Speaker 2: information from its neighbors to calculate routes, rather than having
Speaker 2: the full map itself. It keeps track of feasible successor
Speaker 2: routes for instant failover.
Speaker 1: Best to both worlds. Maybe house configuration also pretty straightforward.
Speaker 2: Router I group as number, that as number must match
Speaker 2: on all EIGRP routers in the same system for them
Speaker 2: to talk. Critical Then, similar to RIP, you use network
Speaker 2: commands for the interfaces you want included, and no auto
Speaker 2: summary is usually recommended here too.
Speaker 1: Okay, and presumably they're IPv six versions two, OSPF three
Speaker 1: and EIGRPV six.
Speaker 2: Absolutely OSPF three for IPB six, OSPF and eigrpv six
Speaker 2: similar principles, different command sets. TAP for IPB six addressing
Speaker 2: and features.
Speaker 1: All right, so we can get packets flowing between networks.
Speaker 1: But networks need more than just basic routing to be
Speaker 1: usable day to day. What about getting IP addresses automatically?
Speaker 1: DHCP seems vital for just plugging in and working.
Speaker 2: Oh, DHCP is fundamental dynamic host configuration protocol. Imagine manually
Speaker 2: setting the IP mask, gateway and DNS on every single computer.
Speaker 1: Chaos typos everywhere, IP conflicts exactly.
Speaker 2: DHCP automates all that. That device boots up, ask for
Speaker 2: an address, and the DHCP server hands out all the
Speaker 2: necessary info dynamically from a predefined pool. In smaller networks, yeah,
Speaker 2: the router itself often acts as the DHCP server.
Speaker 1: How do you set that up on a Cisco router?
Speaker 2: Pretty easy? First, you might want to exclude some addresses
Speaker 2: from being handed out, maybe for your servers or printers.
Speaker 2: You use IPDHGP excluded address startup.
Speaker 1: And IP reserve some addresses right.
Speaker 2: Then you define the pool itself IPDHDP pool pool name.
Speaker 2: Inside that pool can fig You specify the network address
Speaker 2: and masket covers, the default router which is the gateway
Speaker 2: IP for clients, and the DNS server addresses clients should use.
Speaker 2: Saves a ton of manual effort and prevents errors.
Speaker 1: Definitely an unsung hero. Now, connecting this to the bigger picture,
Speaker 1: once a device has an IP, security is the next
Speaker 1: big thought. Access control lists acls the network bodyguards you
Speaker 1: call them.
Speaker 2: Tell us about those, Yeah, acls are your traffic filters,
Speaker 2: the digital bouncers. They're basically ordered lists of permit or
Speaker 2: deny rules that you apply to router interface.
Speaker 1: Ordered so the sequence matters critically.
Speaker 2: The router check the packet against the ACL rules line
Speaker 2: by line, from top to bottom. As soon as it
Speaker 2: finds a match, it stops processing and takes the action
Speaker 2: permit or deny. If it gets the end about a match,
Speaker 2: there's an invisible deny any rule that blocks everything else
Speaker 2: implicit deny.
Speaker 1: Got to remember that what kinds of rules can you make?
Speaker 2: Two main types. Standard acls are simple. They only look
Speaker 2: at the source IP address. Good for basic filtering, but
Speaker 2: not very granular.
Speaker 1: So block everyone from network a exactly.
Speaker 2: Extended acls are way more powerful. They can filter based
Speaker 2: on source IP, destination IP, the protocol at KCPUDPICMP, and
Speaker 2: even source and destination port numbers.
Speaker 1: AH, so you could say, allow this PC to access
Speaker 1: that web server on port eighty, but block everything else.
Speaker 2: Precisely that level of detail. You create the ACL, give
Speaker 2: it a number or name, add your permit, nice statements,
Speaker 2: and then this is crucial, you apply it to an
Speaker 2: interface using the EAT access group command, specifying whether it
Speaker 2: applies to trafit coming in or going out of that interface,
Speaker 2: in or.
Speaker 1: Out important distinction. All right, okay, final piece or basic connectivity.
Speaker 1: How do our private internal networks using those one hundred
Speaker 1: and ninety two point one six eight addresses actually talk
Speaker 1: to the public Internet NAT?
Speaker 2: Right?
Speaker 1: Network address translation absolutely essential. The problem is those private
Speaker 1: ips ten dot one seventy two point one six dot
Speaker 1: one two point one six eight dot. They're not allowed
Speaker 1: on the public Internet. ISPs just drop packets with those source.
Speaker 2: Addresses, so they're trapped in site exactly. Not access the
Speaker 2: translator at your network edge, usually on your border, router
Speaker 2: or firewall. It takes a packet going out from a
Speaker 2: private IP, swaps the source address to a valid public
Speaker 2: IP address, sends it out, and remembers the translation. When
Speaker 2: the reply comes back to the PUBLICIP, NAT translates it
Speaker 2: back to the original private IP like.
Speaker 1: A receptionist handling mail for everyone inside different types YEP.
Speaker 2: Static NAT is a one to one mapping. One private
Speaker 2: IP always translates to the same public IP. Good for
Speaker 2: servers you need to reach from the internet. DYNAMICNAT maps
Speaker 2: a pool of private ips to a pool of public
Speaker 2: ips on a first come, first serve basis.
Speaker 1: But what if you have more devices than publicyps.
Speaker 2: That's where the most common type comes in PAT port
Speaker 2: address translation or NAT overload. This lets many private ips
Speaker 2: share a single public IP address.
Speaker 1: How does that work? Magic?
Speaker 2: Almost? It uses different source port numbers for each outgoing
Speaker 2: connection to keep track of which internal device made which request.
Speaker 2: So your PC talking toogogle dot com might use publicipa
Speaker 2: dot port five zero zero one one, Your phone talking
Speaker 2: to Facebook dot com uses PUBLICIP dot port five zero
Speaker 2: zero zero, and so on.
Speaker 1: Clever how's it can big look?
Speaker 2: You usually define which internal traffic needs translating using an ACL.
Speaker 2: Then you use a command like ipnet inside source list
Speaker 2: ACL name interface gigabeit ethernet zero overload for PAT, telling
Speaker 2: it to use the IP address of the outside interface
Speaker 2: and overload it. Finally, you mark your internal interfaces with
Speaker 2: ipnet inside and your external interface with ipnet outside.
Speaker 1: Inside outside makes sense. It's like the border chappoint. Okay,
Speaker 1: shifting to more advanced stuff. Now, managing switches and ensuring uptime.
Speaker 1: Let's start with VTP for vlands across multiple switches.
Speaker 2: Right, VTP VLAN trunking protocol. This is a Cisco thing again.
Speaker 2: It helps you manage your VLAN database across a bunch
Speaker 2: of switches without configuring each one manually.
Speaker 1: Sounds useful.
Speaker 2: Oh, you set up a VDP domain one switch access
Speaker 2: the server you create, delete or rename VLANs only on
Speaker 2: the server. VTP then automatically pushes those changes out to
Speaker 2: all the other switches configured as clients in the same domain.
Speaker 1: So centralized vland management exactly.
Speaker 2: You need to set the VTP domain name and the
Speaker 2: VTP mode server client or transparent transparent switches past VDP infhoe,
Speaker 2: but don't apply it. Optionally, add a VTP password for
Speaker 2: security saves a lot of time and prevents typos when
Speaker 2: you have dozens of switches.
Speaker 1: Cool. Now a really critical one for stability, spanning tree
Speaker 1: protocol preventing loops. Loops sound bad.
Speaker 2: Loops are network death if you have redundant links between switches.
Speaker 2: For backup, but don't manage them. Broadcast traffic can loop infinitely,
Speaker 2: amplifying until the network collapses. It's called the broadcast storm.
Speaker 2: STP prevents this.
Speaker 1: How does it stop the loops?
Speaker 2: It intelligently detects redundant paths and logically blocks one of them,
Speaker 2: putting the port into a blocking state, so no loop forms.
Speaker 2: If the primary path fails, STP automatically unblocks the backup
Speaker 2: path very quickly.
Speaker 1: Smart Can you tweak it?
Speaker 2: Oh? Yeah, you can set the STP version Spanning tree
Speaker 2: mode rapid PVSD is usually preferred now because it's much
Speaker 2: faster than the old version. You can influence which switch
Speaker 2: becomes the root the center of the SDP topology by
Speaker 2: changing the priority like spanning tree land ten priority forty
Speaker 2: ninety six lower priority wins.
Speaker 1: And what about ports connected to PCs? They don't cause loops? Right? Right?
Speaker 2: For those ports connected to end devices, you use spanning
Speaker 2: tree port fast. This tells STP don't bother with the
Speaker 2: usual delay checking for loops here, just bring the port
Speaker 2: up immediately, makes devices connect much faster.
Speaker 1: Port fast good for user experience. Okay, what if we
Speaker 1: want more bandwidth between switches, not just redundancy. Can we
Speaker 1: bundle links?
Speaker 2: Absolutely? That's ether channel. It lets you take multiple physical links,
Speaker 2: say two or four gigabit Ethernet ports, and bundle them
Speaker 2: into a single logical link.
Speaker 1: So two one GB links become one logical two dB
Speaker 1: link exactly.
Speaker 2: You get the combined bandwidth, and you get redundancy. If
Speaker 2: one physical link in the bundle fails, traffic just continues
Speaker 2: over the remaining ones.
Speaker 1: Wait any roles big one.
Speaker 2: All physical interfaces in an ether channel bundle must have
Speaker 2: identical configurations speed, duplex, vlands, allowed, trunking mode.
Speaker 1: Everything makes sense. How do you set it up?
Speaker 2: There are negotiation protocols. LACP is the industry standard mode
Speaker 2: active or passive, PAP is Cisco proprietary mode desirable or auto,
Speaker 2: or you can just force it on. You typically configure
Speaker 2: the physical ports first, then add them to a channel
Speaker 2: group like Channel group one mode active.
Speaker 1: Cool, bundling for power. Lastly, for this section, router redundancy,
Speaker 1: what if our main router, our default gateway dies, everything
Speaker 1: stops right? How do we prevent that.
Speaker 2: Critical question for uptime? That's where first top redundancy protocols
Speaker 2: or fhrps come in. The most common Cisco one is
Speaker 2: HSRP hot standby.
Speaker 1: Router protocolst stand by.
Speaker 2: The idea is you have two or more routers connected
Speaker 2: to the same network segment. They work together to present
Speaker 2: a single virtual IP address and virtual M address to
Speaker 2: the client devices on that network.
Speaker 1: So the PCs use this virtual IP as their gateway.
Speaker 1: They don't know about the two real routers exactly.
Speaker 2: It's an illusion. One router is elected active and actually
Speaker 2: handles the traffic sent to the virtual IP. The other
Speaker 2: router are standby, just listening. If the active router fails
Speaker 2: stop sending HSRP Hello messages, a standby router instantly takes
Speaker 2: over the active role, and the virtual IPM mass addresses.
Speaker 1: Seamless failover nice key commands.
Speaker 2: On the interface, you set the virtual IP with standby
Speaker 2: group number IP virtual IP. You usually enable standby preempt,
Speaker 2: which allows a router with higher priority to take back
Speaker 2: the active role if it comes online. You set the
Speaker 2: priority with standby priority value higher is better, and you
Speaker 2: can use standby track to monitor another interface. If that
Speaker 2: tracked interface goes down, the router decreases its own HSRP priority,
Speaker 2: potentially triggering a failover.
Speaker 1: That tracking seems smart failover even if the router itself
Speaker 1: isn't totally dead.
Speaker 2: Very useful. It provides resilience against upstream link failures too.
Speaker 1: Fascinating. The virtual IP is the key. Okay, let's level
Speaker 1: up again. When networks get really big, spanning different organizations,
Speaker 1: different autonomous systems, how do they talk BGP? Right? This
Speaker 1: sounds complex?
Speaker 2: It is complex? Ye BGP. The Border Gateway Protocol is
Speaker 2: basically the routing protocol of the Internet itself. When different companies, ISPs,
Speaker 2: large organizations each running their own autonomous system or as,
Speaker 2: need to exchange routing information between each other, they use
Speaker 2: EBGP external BGP.
Speaker 1: So it's how the different chunks of the Internet.
Speaker 2: Connect Precisely, It's less about finding the fastest path like OSPF,
Speaker 2: and more about enforcing policy which networks am I allowed
Speaker 2: to tell this other as about which routes am I
Speaker 2: willing to accept from them. It controls reachability across the.
Speaker 1: Globe policy, not just speed. Got it? What are the
Speaker 1: basic commands?
Speaker 2: You start the BGP process with orbgp or as number.
Speaker 2: Then you define your neighbors and other ass using neighbor
Speaker 2: neighbor IP remote as neighbor s number. You also tell BGP,
Speaker 2: which of your local networks you want to advertise using
Speaker 2: network adjust mask subnetmask seems straightforward enough at first glance
Speaker 2: the basics are, but BGP has tons of attributes and
Speaker 2: policies you can manipulate for stability, especially with EVGP neighbors
Speaker 2: that might not be directly connected. You often see the
Speaker 2: MGP multi hoop used and crucially updates source loop back.
Speaker 1: Why use a loop back interface?
Speaker 2: Because a loopback interface is virtual, It's always up unless
Speaker 2: the router is dead. Physical interfaces can flap up and down.
Speaker 2: Tying your BGP session to a stable loopback IP makes
Speaker 2: the connection much more resilient to physical link issues. Vital
Speaker 2: for Internet stability.
Speaker 1: Makes sense stable source for a critical protocol. Okay, stepping
Speaker 1: back from the global Internet. What about simple point to
Speaker 1: point links like an old serial connection to an ISP ah?
Speaker 2: Yeah, for those dedicated point to point links, the classic
Speaker 2: protocol is PPP, the point to point protocol. You enable
Speaker 2: it on the interface with encapsulation PPP is that that
Speaker 2: terms on PPP, but you usually need authentication too. PPP
Speaker 2: supports PPP password Authentication Protocol and c CHATP Challenge Handshake Authentication.
Speaker 1: Protocol pp and CPP difference.
Speaker 2: Pp sends the username and password in clear text not great.
Speaker 2: T CHAP is much more secure. It uses a challenge
Speaker 2: response mechanism with hashing, so passwords aren't sent over the wire.
Speaker 2: You can figure PPP authentication.
Speaker 1: Chat GPOP is better, always.
Speaker 2: Pretty much always. PPP also has a cool feature called
Speaker 2: multilink PPP. If you have multiple physical serial links to
Speaker 2: the same destination, you can bundle them together into PPP
Speaker 2: multilink Group one, for instance, to aggregate bandwidth and provide redundancy.
Speaker 1: Like Ether channel, but for serial links.
Speaker 2: Similar concept. Yeah, and the guide mentions PPPoE briefly PPP
Speaker 2: over Ethernet. That's super common for DSL and some cable
Speaker 2: Internet connections running PPP sessions inside Ethernet frames.
Speaker 1: Right, seeing that setting on homewriters, Yeah, okay. Beyond just connecting,
Speaker 1: how do we build secure tunnels over public networks like
Speaker 1: the Internet? Connecting branch offices securely for example GRE and
Speaker 1: IPsec VPNs Exactly.
Speaker 2: If you just need a simple tunnel to carry routing
Speaker 2: protocol traffic, for example, but don't necessarily need encryption, you
Speaker 2: can use GRE generic routing encapsulation.
Speaker 1: How does that work?
Speaker 2: You create a virtual interface tunnel zero, give it an
Speaker 2: IP address for the tunnel itself. Then you specify the
Speaker 2: tunnel source, your public IP and tunnel destination. The remote
Speaker 2: routers public IP GRE basically wraps the original packet inside
Speaker 2: another IP header, but critically it's not encrypted.
Speaker 1: No encryption, so not for sensitive.
Speaker 2: Data, definitely not. It's like sending postcard. For actual secure communication,
Speaker 2: you need an IPsec VPN. This builds an encrypted tunnel,
Speaker 2: usually for site to site connections.
Speaker 1: IP six sounds serious? Is it complicated?
Speaker 2: It has quite a few moving parts. Yeah, it's usually
Speaker 2: breaking down to two phases. Phase one is setting up
Speaker 2: a secure management channel called the IKEASA or ice mpsa.
Speaker 1: IKE Phase one. What happens there?
Speaker 2: You define a crypto ISAAC policy where both sides agree
Speaker 2: on the security parameters, the encryption algorithm like as the
Speaker 2: hash algorithm like SAHA for integrity, the authentication method usually
Speaker 2: pre share for pre shared keys, and a Diffie Hellman
Speaker 2: group for secure key exchange. You also define the interesting
Speaker 2: traffic what data should trigger the VPN using an ACL,
Speaker 2: and you set the CRYPTOIACP the pre shared secret for
Speaker 2: the remote peer.
Speaker 1: Okay, that sets up the secure handshake.
Speaker 2: Then Phase two I like Phase two, builds the actual
Speaker 2: data tunnel the ipc SA. Here you define a crypto
Speaker 2: IPSECT transform set specifying the encryption like s disease and
Speaker 2: authentication SPSHAWMAC for the data packets themselves. Mode tunnel is
Speaker 2: standard for site to site. Finally, you tie everything together
Speaker 2: in a cryptomap. The cryptompp references the ACL for interesting
Speaker 2: traffic sets, the remote peer points to the transform set,
Speaker 2: and then you apply this cryptomap to your outside facing
Speaker 2: physical interface.
Speaker 1: Wow, a lot of steps, but it sounds like it
Speaker 1: builds a very secure pipe.
Speaker 2: It does get all the pieces right and you have
Speaker 2: strong encryption protecting your data across the internet.
Speaker 1: Fantastic breakdown. Thanks. Okay, last section. We've built the network,
Speaker 1: secured it, but we need to manage it, monitor it,
Speaker 1: fix it when it breaks. What tools does Cisco iOS
Speaker 1: give us?
Speaker 2: Absolutely crucial part for starters. ACLS on IPv six We
Speaker 2: mentioned them, but just to reiterate, they work much like
Speaker 2: IPv four ACLS filtering IPv six traffic. You apply them
Speaker 2: with IPv six Traffic filter on interfaces or IPv six
Speaker 2: Access Class on btwoylines.
Speaker 1: Okay, filtering for IPv six what else?
Speaker 2: SNMP Simple Network Management Protocol. This is the standard way
Speaker 2: for network management systems like Solar Winds, PRTG, et cetera
Speaker 2: to poll devices for information, cp load, interface traffic errors,
Speaker 2: and sometimes even make configuration changes. SNMPv three is the
Speaker 2: secure version, though it's configuration with views, groups, users off
Speaker 2: prif passwords can be complex.
Speaker 1: SNNP for monitoring. Got it?
Speaker 2: Then there's SPAN Switchport Analyzer, super useful for troubleshooting on switches.
Speaker 2: It lets you mirror all the traffic from a source
Speaker 2: port or even a whole VLAN to a destination port.
Speaker 1: Why would you do that?
Speaker 2: You plug a laptop running wirior Shark or some other
Speaker 2: packet sniffer into that destination port and you can see
Speaker 2: an exact copy of all the traffic from the source
Speaker 2: without interrupting the actual users. Great for diagnosing tricky application
Speaker 2: issues or security investigations. Commands look like monitor Session one
Speaker 2: source interface Gigabyte Ethernet zero one and monitor Session one
Speaker 2: destination interface Gigabyte Ethernet zero five.
Speaker 1: Like putting a tap on the line non disruptively clever.
Speaker 2: Very clever, And lastly IPSLA Service level Agreement monitoring. This
Speaker 2: lets the router itself actively test network paths and performance.
Speaker 1: The router tests things itself YEP.
Speaker 2: You can configure it, for example, to send ICMP echos
Speaker 2: pings to a critical server every thirty seconds using IPSI
Speaker 2: one ICP echo one ninety two point one six eight
Speaker 2: point one point five frequency thirty. Then you schedule it
Speaker 2: to run with ipslast schedule one start time, now, lifetime forever.
Speaker 2: The riter trucks response times, jitter, packet loss. You can
Speaker 2: then use this data for alerts or even tie it
Speaker 2: into routing decisions, like changing routes if a primary path
Speaker 2: becomes unreliable.
Speaker 1: Proactive monitoring built right in.
Speaker 2: That's powerful, very powerful for ensuring performance and availability meet
Speaker 2: required levels.
Speaker 1: Wow, what an incredible journey. Seriously, we went from just
Speaker 1: plugging in or out or giving it a name in
Speaker 1: very basics all the way through vlands, complex routing like OSPF, EI,
Speaker 1: g RP, even BGP, the Internet's glue, plus security with ACLS, VPNs,
Speaker 1: and these essential management tools like SPAN and IPSLA. It's
Speaker 1: a lot, but each piece is so important.
Speaker 2: It really is a vast landscape, isn't it. But that's
Speaker 2: the point of the steep dive. Using the command guide
Speaker 2: as our map. It's about giving you, the listener, a
Speaker 2: shortcut distilling that practical knowledge you absolutely need for modern networks,
Speaker 2: moving beyond just what the command is exactly, to the
Speaker 2: why why does it matter? How does enable secret protect you?
Speaker 2: Why does ospf use cost? Why is no shutdown so vital?
Speaker 2: That deeper understanding is where the real skill comes in,
Speaker 2: not just configuring, but designing, troubleshooting, optimizing, making things actually.
Speaker 1: Work well well said. So as you, our listener, continue
Speaker 1: on your own networking journey, maybe digesting all this, we
Speaker 1: want to leave view with the thought to chew on something.
Speaker 1: I'm all over YEA, what single seemingly simple network command
Speaker 1: maybe one we discussed, maybe another when you really really
Speaker 1: understand it deeply. What command might unlock a surprising amount
Speaker 1: of power or insight for you in a big, complex
Speaker 1: network