Explain the role and function of network components

A network is a collection of devices connected so that they can exchange data. The devices that people use directly (laptops, phones, printers, servers) are called endpoints or hosts. The devices that exist only to move data between hosts (switches, routers, access points, firewalls) are called network devices or infrastructure. This objective asks you to know what each kind of device does and, just as importantly, what it does not do.

Before we look at the devices themselves, you need a mental model of how data moves. That model is the OSI reference model, and it is the single most useful idea in this chapter.

Foundations: the OSI and TCP/IP models

Computers communicate by following protocols, which are agreed-upon rules for formatting and exchanging data. Networking involves many protocols working together, and to keep them organized the industry describes them in layers. Each layer provides a service to the layer above it and relies on the layer below it. A layer only needs to understand its own job, not the jobs of the other layers. This is the same idea as a postal system: the person writing a letter does not need to know how trucks are routed, and the truck driver does not need to read the letter.

The OSI model (Open Systems Interconnection, published by ISO) defines seven layers. It is a reference model: real-world protocols do not always map to it neatly, but everyone in networking uses its layer numbers as a shared vocabulary. When a colleague says “that is a Layer 2 problem,” they mean the OSI Data Link layer.

A popular memory aid, from Layer 7 down to Layer 1, is “All People Seem To Need Data Processing.” From the bottom up, “Please Do Not Throw Sausage Pizza Away.”

The TCP/IP model is the model the Internet was actually built on. It has fewer layers, because its designers combined the top three OSI layers into one and (in the original four-layer version) combined the bottom two. The modern five-layer version is the one Cisco uses in CCNA material.

The original four-layer TCP/IP model simply merges Data Link and Physical into a single “Network Access” or “Link” layer.

Encapsulation is the process each layer uses to wrap the data it receives from the layer above with its own header (and sometimes a trailer). When your web browser sends a request, the following happens on the way down the stack:

1. The application produces data (an HTTP request).
2. The Transport layer adds a TCP header (source and destination port numbers, sequence numbers). The result is called a segment.
3. The Network layer adds an IP header (source and destination IP addresses). The result is a packet.
4. The Data Link layer adds an Ethernet header (source and destination MAC addresses) and a trailer (a checksum). The result is a frame.
5. The Physical layer turns the frame into electrical, light, or radio signals: bits.

The receiving host does the reverse, de-encapsulation, stripping one header at each layer on the way up. Each of these named units (segment, packet, frame) is a PDU, or Protocol Data Unit. The exam expects you to know which name belongs to which layer.

Foundations: Ethernet frames and MAC addresses

Ethernet (defined by the IEEE 802.3 standards) is the dominant Layer 1 and Layer 2 technology for wired LANs. A LAN (Local Area Network) is a network in a single location, such as one building. Ethernet defines both the physical cabling and the format of the frame carried over it.

Every Ethernet network interface is assigned a MAC address (Media Access Control address), a 48-bit (6-byte) identifier burned into the hardware by the manufacturer. It is also called the physical address, hardware address, or burned-in address (BIA). MAC addresses are written as 12 hexadecimal digits. Cisco IOS writes them in three groups of four separated by dots (0050.56be.1a2b); Windows uses hyphens (00-50-56-BE-1A-2B); Linux and macOS use colons (00:50:56:be:1a:2b). They are all the same address.

The first 24 bits (first 6 hex digits) are the OUI (Organizationally Unique Identifier), assigned by the IEEE to a specific vendor. The last 24 bits are assigned by that vendor and must be unique for that OUI. Two special bits live in the first byte: the least-significant bit is the I/G bit (0 = individual/unicast, 1 = group/multicast), and the second-least-significant bit is the U/L bit (0 = universally administered, burned in; 1 = locally administered). The U/L bit becomes important again in IPv6 EUI-64 (section 1.9.d).

Three kinds of destination MAC address exist:

• Unicast: one specific interface (I/G bit = 0).
• Broadcast: every device on the LAN. The address is all ones, ffff.ffff.ffff.
• Multicast: a group of interested devices. Ethernet multicast addresses have the I/G bit set; IPv4 multicast maps to 0100.5exx.xxxx and IPv6 multicast to 3333.xxxx.xxxx.

An Ethernet frame has the following fields (sizes in bytes):

The header (destination, source, type) is 14 bytes and the trailer (FCS) is 4 bytes, for 18 bytes of overhead. Because the payload must be 46 to 1500 bytes, a legal frame is 64 to 1518 bytes long (the preamble and SFD are not counted). A frame carrying an 802.1Q VLAN tag (Domain 2) is 4 bytes longer, up to 1522 bytes. The 1500-byte payload limit is the Ethernet MTU (Maximum Transmission Unit).

The FCS works like this: the sender runs a mathematical function called a CRC (Cyclic Redundancy Check) over the frame and stores the result in the FCS. The receiver runs the same function and compares. If the results differ, the frame was damaged in transit and is silently discarded. Ethernet does not ask for a retransmit; that is the job of upper layers such as TCP.

1.1.a Routers

A router is a Layer 3 device that connects different networks and forwards packets between them based on the destination IP address. Every router interface belongs to a different IP network (subnet), and the router’s job is to choose the best path toward any destination network it knows about.

Routers do three essential things:

1. Separate broadcast domains. A broadcast (a message to everyone on the LAN) stops at the router. This keeps large networks from being drowned in broadcast traffic. A broadcast domain is the set of devices that receive each other’s Layer 2 broadcasts; each router interface is the boundary of one.
2. Make path decisions. The router keeps a routing table listing which networks are reachable through which interface or next-hop router. It learns routes from directly connected interfaces, from static routes an administrator types in, and from dynamic routing protocols such as OSPF (Domain 3).
3. Connect dissimilar networks. A router can have an Ethernet interface on one side and a fiber, serial, cellular, or DSL WAN interface on the other, and it rewrites the Layer 2 frame on each hop so the packet can cross each medium.

When a packet arrives, the router strips the Layer 2 frame header, examines the destination IP address, looks up the longest matching prefix in the routing table, decrements the packet’s TTL (Time To Live) field, and builds a new Layer 2 frame for the outgoing interface. The IP addresses in the packet do not change as it crosses routers (unless NAT is involved), but the MAC addresses change at every hop.

Modern routers also commonly perform NAT, act as DHCP servers, terminate VPNs, apply access control lists (ACLs), and enforce QoS. Cisco’s ISR (Integrated Services Router) family is the typical branch router; the ASR and Catalyst 8000 families serve larger sites and service providers.

1.1.b Layer 2 and Layer 3 switches

A switch is the device that endpoints plug into. A traditional switch is a Layer 2 switch: it forwards frames based on the destination MAC address and has no understanding of IP addresses at all (apart from a single management address so you can log in to it). Switches have many ports, typically 24 or 48, and every port is its own collision domain, meaning devices on different ports never compete for the wire. All ports in the same VLAN are in one broadcast domain.

A Layer 2 switch learns which MAC address lives on which port by reading the source MAC of incoming frames, stores that in its MAC address table, and uses the table to send each frame only out the correct port. Section 1.13 covers this process in detail. Switches replaced hubs, which were Layer 1 repeaters that simply copied every bit to every port, forcing all attached devices to share one collision domain.

A Layer 3 switch (also called a multilayer switch) is a switch that can also route. It has the same dense port count and hardware forwarding as a Layer 2 switch, plus the ability to create SVIs (Switched Virtual Interfaces, one per VLAN) with IP addresses, and to forward packets between VLANs in hardware. Because it routes in ASICs (special-purpose chips) rather than in software, it is extremely fast, and it is the standard way to route between VLANs inside a campus. What a Layer 3 switch usually lacks compared with a router is WAN interface options and advanced services such as full-featured NAT, VPN, and deep QoS.

! Turn a Layer 3 switch into an inter-VLAN router
SW1(config)# ip routing
SW1(config)# interface vlan 10
SW1(config-if)# ip address 10.1.10.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# interface vlan 20
SW1(config-if)# ip address 10.1.20.1 255.255.255.0
SW1(config-if)# no shutdown

1.1.c Next-generation firewalls and IPS

A firewall is a security device that sits between two zones of different trust, most commonly between your internal network and the Internet, and permits or denies traffic based on rules. A traditional firewall examines Layer 3 and Layer 4 headers: source and destination IP addresses, protocol, and port numbers. Most are stateful, meaning they remember outbound connections (the “state”) so that the matching return traffic is allowed automatically while unsolicited inbound traffic is dropped. A stateless filter, such as a simple ACL on a router, evaluates each packet on its own without that memory.

A Next-Generation Firewall (NGFW) adds intelligence above Layer 4:

• Application awareness (AVC, Application Visibility and Control): it can tell Facebook from Salesforce even though both use HTTPS on port 443, and apply rules per application.
• Integrated IPS: see below.
• URL and content filtering: blocking categories of websites.
• Advanced malware protection (AMP): inspecting files against threat intelligence.
• TLS decryption: inspecting inside encrypted sessions.
• User identity integration: rules based on who the user is, not just the IP.

Cisco’s NGFW products are the Firepower / Secure Firewall Threat Defense (FTD) appliances, and earlier the ASA with Firepower services.

An IPS (Intrusion Prevention System) inspects the content of traffic looking for patterns, called signatures, that match known attacks (exploits, worms, command-and-control traffic), and can also detect anomalies. An IPS sits inline in the traffic path and can drop malicious packets in real time. Its older cousin, the IDS (Intrusion Detection System), receives a copy of traffic (for example from a switch port mirror) and can only alert, not block. A Next-Generation IPS (NGIPS) adds contextual awareness of the hosts and applications it protects so it can prioritize alerts and reduce false positives. In most modern deployments the IPS is a feature of the NGFW rather than a separate box.

1.1.d Access points

A wireless access point (AP) is the device that lets Wi-Fi clients join the wired network. It has one or more radios (2.4 GHz, 5 GHz, and increasingly 6 GHz) and an Ethernet uplink to a switch. At Layer 2 the AP behaves like a bridge: it converts 802.11 wireless frames into 802.3 Ethernet frames and vice versa, and does not route or NAT. Wireless clients associated with an AP are in the same broadcast domain as the VLAN the AP bridges them onto.

Access points come in two operational models (covered in depth in Domain 2):

• Autonomous APs are configured individually and make all decisions locally. This is fine for a few APs, painful for a few hundred.
• Lightweight APs download their configuration from a Wireless LAN Controller (WLC) and tunnel client traffic to it using the CAPWAP protocol. The AP handles real-time radio functions; the controller handles everything else.

Because APs are usually mounted on ceilings far from power outlets, they are almost always powered over their Ethernet cable using PoE (1.1.h). A home “wireless router” is really an AP, a switch, a router, a firewall, and a DHCP server in one box.

1.1.e Controllers

A controller is a device (physical appliance, virtual machine, or cloud service) that centralizes the “brain” of many network devices so that an administrator manages one system instead of dozens or thousands of individual boxes. Two kinds appear on the CCNA:

• Wireless LAN Controllers (WLCs) manage lightweight access points. The WLC pushes out SSIDs, security settings, channel and power assignments, and authenticates clients. Cisco’s Catalyst 9800 is the current WLC platform. WLC concepts are examined in Domain 2.
• SDN controllers (Software-Defined Networking) manage switches and routers. The controller holds the network-wide view (the control plane) and programs the forwarding behavior (the data plane) of each device. Cisco Catalyst Center (formerly DNA Center) manages campus networks and Cisco SD-Access; Cisco APIC manages ACI data center fabrics; Meraki Dashboard manages cloud-managed devices. Controllers expose northbound APIs to applications and use southbound APIs (NETCONF, RESTCONF, OpenFlow, SSH) to talk to devices. Domain 6 covers this.

The important idea for objective 1.1 is the role: a controller does not usually forward user traffic itself; it configures, monitors, and coordinates the devices that do.

1.1.f Endpoints

An endpoint is any device where traffic originates or terminates: desktops, laptops, smartphones, tablets, IP phones, printers, cameras, badge readers, thermostats, and other IoT (Internet of Things) devices. Endpoints are the reason the network exists. From the network’s point of view an endpoint has a MAC address, usually obtains an IP address via DHCP, and talks to a default gateway.

Endpoints matter to network engineers for two reasons. First, they are the largest attack surface in most organizations, which is why features such as port security, 802.1X, and DHCP snooping (Domain 5) exist to control what an endpoint may do. Second, the type of endpoint dictates design choices: an IP phone needs PoE and a voice VLAN, a camera needs PoE and multicast, a guest laptop needs isolation.

1.1.g Servers

A server is a computer that provides a service to other devices (clients). The word describes a role, not a piece of hardware: a powerful rack-mounted machine running a database is a server, and so is a virtual machine running DNS. Common network services and the protocols they use include web (HTTP/HTTPS), email (SMTP, POP3, IMAP), file (FTP, SMB, NFS), name resolution (DNS), address assignment (DHCP), time (NTP), authentication (RADIUS, TACACS+, LDAP), and logging (syslog).

Servers typically live in a data center or a server room, are connected with faster links (10 Gbps or more, often fiber), are assigned static IP addresses so clients can always find them, and are grouped in their own VLANs behind firewalls. Most modern servers are virtual machines or containers running on a hypervisor (1.12). The client/server model, in which a client initiates a request and a server responds, is the basis of almost all Internet traffic, and understanding which side “listens” on a well-known port is essential for section 1.5.

1.1.h PoE

Power over Ethernet (PoE) delivers DC electrical power to a device over the same twisted-pair Ethernet cable that carries its data, so that phones, access points, cameras, and sensors need no separate power adapter. The device that supplies the power is the PSE (Power Sourcing Equipment), usually a PoE-capable switch but sometimes a mid-span PoE injector. The device that receives it is the PD (Powered Device).

PoE is defined by IEEE 802.3 amendments, each raising the power budget:

The difference between PSE and PD power is lost to cable resistance over the allowed 100 m. Cisco also has proprietary UPOE (60 W), which predates 802.3bt, and UPOE+ (90 W); both behave similarly to 802.3bt.

PoE is safe for non-PoE devices because the switch does not simply blast power onto every port. The process is:

1. Detection. The PSE applies a small test voltage and looks for the specific 25 kilohm signature resistance that a PD presents. No signature, no power.
2. Classification. The PSE determines how much power the PD needs, either from its hardware class (0 to 8) or through negotiation using CDP or LLDP (the Layer 2 discovery protocols from Domain 2), which allows fine-grained requests.
3. Power-up and monitoring. The PSE supplies power and keeps monitoring current. If a PD draws more than it was granted, power policing can log the event or shut the port down (err-disable it).

Every switch has a total power budget; a 48-port switch may not be able to supply 30 W on all 48 ports at once, so PoE is allocated first-come first-served, with priority options.

! PoE is on by default (auto) on PoE-capable ports; these are typical settings
SW1(config)# interface gigabitethernet 1/0/5
SW1(config-if)# power inline auto
! Cap the port at 15.4 W even if the device asks for more
SW1(config-if)# power inline auto max 15400
! Enforce policing: err-disable a device that exceeds its allocation
SW1(config-if)# power inline police
! Disable PoE entirely on a port connected to a desktop PC
SW1(config-if)# interface gigabitethernet 1/0/6
SW1(config-if)# power inline never

SW1# show power inline
Module   Available     Used     Remaining
          (Watts)     (Watts)    (Watts)
------   ---------   --------   ---------
1           370.0       45.6       324.4
Interface Admin  Oper       Power   Device              Class Max
                            (Watts)
--------- ------ ---------- ------- ------------------- ----- ----
Gi1/0/1   auto   on         15.4    IP Phone 8845       3     30.0
Gi1/0/2   auto   on         30.0    AIR-AP3802I-B-K9    4     30.0
Gi1/0/3   auto   off        0.0     n/a                 n/a   30.0
Gi1/0/6   off    off        0.0     n/a                 n/a   30.0