Converged Network

The converged network is such a network that designed to handle voice, video, and data.  The network consists of Layer 3 devices and Layer 2 devices, such as routers and switches. The router should be in position of routing table to accurately and efficiently send data to remote destinations. The converged network must be developed with an architectural approach that embeds intelligence, simplifies operations, and is scalable for future demand.

Elements of a Converged Network

To support a business community networks converged solutions using voice systems, IP phones, voice gateways, video support, and video conferencing. Including data services, a converged network with teamwork support might include following features.

• Call Management - Call processing, caller Identification, call conference ,hold and transfer
• Voice Messaging
• Mobile Call Facility where required
• Automated attendant

All in one is the primary benefits of transitioning to the this type of network because there is just one physical network to install and manage all the above services. Separate network for all the above services is too costly. So, there are considerable savings over the installation and management of converged network for the above services. The converged network solution integrates IT management thus that any change and additions are completed with an keen management interface. This solution also provides computer soft phone application support and point-to-point video, thus that users can enjoy communications with the same ease of administration and use as a voice call.

The services convergence onto the network has resulted in an development in networks from a traditional data transport role to high speed data, voice, and video communication. This one physical converged network should be accurately planned and implement to allow the consistent handling of the various types of information that it must carry. A prearranged design is necessary to allow management of this difficult environment. The figure below illustrates the converged network, that one network and many types of data.

Common Show Commands - Cisco IOs

The Show commands display important information about the configuration and operation of the device in the Cisco IOs command Line Interface (CLI) mode. Network administrators use different show commands to examine device status; interfaces, process and configuration files to validate the device operational status. The status of almost all process and function of the router can be view and verify using show command. The important show commands of Cisco IOS are the following:-

• show version
• show running-config
• show arp
• show interfaces
• show protocols
• show ip protocols
• show ip route
• show ip interface brief
• show cdp neighbors

show version

The show version command on Cisco router displays hardware information. The command output gives insight into the routers capabilities. This command can be abbreviated sh ver. The output of show version command consist of following unique information:-

• IOS version
• Image filename
• System uptime
• Type of processor
• Amount of RAM
• Number of ports on the switch
• Amount of flash memory
• Current configuration register

The figure below illustrates the output of the show version command on the Cisco router.

Show running-config

This command is used to display the configuration information currently running on the terminal. We can also use this command in combination with the show startup-config command to compare the information in running memory to the information stored in NVRAM or in a place specified by the CONFIG_FILE. This command can be abbreviated sh ru

show arp

This command displays the ARP table of the router. The ARP table is the table which contains the resolved IPv4 address to MAC address mappings. If a host is can't ping? Make sure using the show arp command that you're getting an arp entry of the host that you want to ping. The command can be abbreviated sh ar .

show interfaces

The show interface command displays all type of interfaces with configuration and statistics. It is very important for the network administrator to know what interfaces are installed and configure in the router. This command provides a lot of information in the output. This command can be abbreviated as sh int.  The figure below illustrates the output of the show interface command.

show protocols

This command displays the status of configured layer three protocols on all interfaces of the Cisco routers. This command can be abbreviated as sh prot

show ip route

The show ip route command is used to show the routing table of the router. The routing table is the list of all networks that the router can communicate; their metrics and how to communicate with them. This command can be abbreviated with sh ip ro. The command also has parameters after route (ro) like sh ip ro rip for all RIP routes. The figure below illustrates the output of the show ip route command

show ip interface brief

The show ip interface brief is one of the most frequently used commands in the Cisco devices. This command provides abbreviated output than the show ip interface command. It provides an outline of the key information for all the network interfaces on a router. The figure below illustrates the output of this command.  The output displays all interfaces on the router; the IP address assigned interfaces, if any, and the operational status of the interface. The show ip interface brief command can also be used to verify the status of the switch interfaces.

Show CDP neighbors

This command display information about the Cisco devices that are connected to your current device. Cisco Discovery Protocol (CDP) is a Cisco proprietary protocol and will only detect Cisco products. To show detailed information about neighboring devices discovered using CDP; use the show cdp neighbors command in privileged EXEC mode. The command can be abbreviated with sh cd ne.

Interpreting Trace Messages

The Trace is a diagnostic utility which displays the route from host to a destination using ICMP echo packets to the destination. it proceeds a list of hops as a packet is routed through a network. it uses varying TTL values as each router down the path is required to decrement the packet's TTL by at least 1 before forwarding the packet, the TTL is working just like a hop counter. When the TTL value reaches zero (0), the router sends an ICMP "Time Exceeded" message back to the source.
The trace command sends the 1^st  echo packet with a TTL of 1 and then increment the TTL by 1 on each successive transmission, until the destination address responds or until the maximum TTL is reached.

When performing the operation from a Windows computer, the command should be tracert, for example

C:\>tracert fschub.com

C:\>tracert < target IP address >

When performing the trace from a router, the command should be traceroute, for example

Router# traceroute fschub.com

Router# traceroute < target IP address >

Figure 1 shows example output of the tracert command entered on host 4 to trace the route to host 1. The only successful response was from the gateway on Router Peshawar and from router Karak. Trace requests to the next hop (Host 1) timed out, meaning that the next hop (Host 1) did not respond. The results indicate that there is either a failure in the internetwork beyond the LAN or that this host configured not to respond to echo requests used in the trace.

Figure 2 shows an example output of the tracert command on host 4 to host 2 and the trace is completed successfully.

Following is an important switch that uses trace command.

-d -  This switch with tracert command specifies to not determine addresses to hostnames

-h maximum_hops  -Specifies the maximum number of hops to search for the target

-j host-list - Specifies loose source route along the host-list (IPv4 only)

-w timeout -Waits the number of milliseconds specified by timeout for each reply

Network Baseline

Do you know your standard network throughput volume and most types of traffic used in your network? If you have no information about the above questions then you should required baseline your network. The network baseline is one of the most useful tools for monitoring and troubleshooting network performance. For the effective network, performance baseline is required over a period of time. Measuring performance at varying times and loads will help in creating a better image of overall network performance

How to baseline a network

To baseline a network, you need to monitor the network traffic for a long time, because a wider time presents a more realistic picture of a traffic pattern. The use of a network baseline is listed below:

• Evaluate network management policies agreement.
• Understand network pattern and traffic trends.
• Speed up troubleshooting network problems.
• Understand network resources allocation.
• Provide network up-gradation history statistics.
• Provide data for decision making to network and security management.

To baseline a network, network administrators need software Colasoft nChronos and Capsa to baseline their networks. Both software is used to listen to packet data of a wire and generate all kinds of a report on the network.

Another method for starting a baseline is to copy, paste and save the results from an executed ping, trace and other related commands into a text file with time and date. These text files can be used to compare with other results, error messages and the response times from host to host. If there is a huge increase in response times, there may be a latency issue to address. The figures below illustrates the result of the ping command for the same IP address with different timings and the comparison of both. 

The output resulting from network commands can contribute data to the network baseline. Commercial networks should have widespread baselines. Professional-grade software tools are available for storing and maintaining baseline information.

Interpreting Ping Results - Cisco Devices

The ping is a very helpful utility to test and troubleshoot network devices connectivity. It uses the Internet Control Message Protocol (ICMP). The ping command indicates the source of the problem. It is an initial step in troubleshooting a network failure.

Cisco IOS Ping Indicators

There are several indicators in IOS for ICMP echo request that was sent. The common indicators for ICMP echo are the following:

! - The mark of exclamation indicates that the ping completed successfully and verifies Layer 3 connectivity along the network path. As shown in Figure below, Karak Router Successfully ping Peshawar router, which IP address is 172.16.0.1

"." The period indicates that there is some problem in connectivity somewhere along the network path. It also indicates that a router along the network path does not configure a route to the destination. If the ping is not allowed in the device it should also give a reply with “.” Indicator. The first echo request timed out is common in the network If the arp process is required. The figure below shows the ping result from Karak router to laptop 3, where “Karak router” has no route to the network 192.168.1.0/24, so its reply with request timed out “.” Indicators.

U – This indicator shows that a router along the network path responded with an ICMP unreachable message because the router did not have a route configure to the destination address. If the ping request is blocked by destination it will also reply with this mark.

Testing the Loopback

To verify the internal IP configuration and protocol stack from the network layer to the physical layer can also be used the ping command instead of putting a signal on the media. The Loopback IP addresses are 127.0.0.1 for IPv4 and ::1 for IPv6.

Extended Ping

The extended ping is one of the best commands offers by Cisco IOS. This is the extended mode of the ping command. To execute extended ping enter ping without destination address in privileged EXEC mode. As shown in the figure below, a series of different prompts are then presented asking different parameters. Pressing Enter without writing something accepts the indicated default values.

The figure below illustrates how to force the source address for a ping to be 192.168.1.1(Router Peshawar); the source address far a standard ping would be 172.16.0.2. The network administrator can verify from Peshawar Router that the Karak Router has a route to 192.168.1.0/24 network.

Router File System

The Cisco IOS File System (IFS) have different directories. The directories available depend on the device. The IFS also allow creating subdirectories in flash memory or on a disk. The figure below display the output of the show file system command, the command lists all of the available file systems on the router.

The command gives helpful information such as the information about available and free memory, the file types, and its permissions. Permissions contain read-only (wr), write-only (ro), and read and write (rw).

The asterisk against flash file system means that the current default file system is flash. The pound symbol (#) appended to the flash indicate that bootable IOS is located in flash.

The Flash File System

The figure below displays the output of the dir command. Flash is the default file system, so the dir command lists the contents of flash.

 

The NVRAM File System

To view and list the contents of NVRAM, the command will be given as dir nvram: in user exec mode. as shown in the Figure below.

Switch File Systems

The show file systems command also show the file systems on a Catalyst switch is the same as on a Cisco router, as shown in the figure.

Backup and Restoring using Text files

Backup

Using Tera Term we can also backup Configuration file and restore configuration when needed from the text file. The steps for backup and restoring using Tera Term is the following:-

1. On the File menu of Tera Term, click Log.


2. Then select location where you want to save the file. Now Tera Term will start capturing.


3. Once capture has been started, execute the show running-config or show startup-config command at the privileged EXEC prompt. The displayed text in the Tera Terminal will be directed to the chosen file.


4. After completing capture, select Close in the Tera Term: Log window.


5. View the file at the chosen location to verify that it was not corrupted.

Restoring

When configuration copied from a text file and pasted it into a terminal window, the InterOperating System executes each line of the text file as a command.  So, the captured file will require editing to make sure that encrypted passwords are in plain text and that there is no non-command text.

Furthermore, the device must be set at the global configuration mode to receive the commands from the text file being pasted into the terminal window. Following are the steps to restore configuration using Tera Term.

1. On the File menu of Tera Term, click Send File


2. Locate the configuration text file to be copied into the device and click Open.


3. Tera Term will paste the file into the device and the text will be applied as a command in the device.

Backup and Restoring Configurations with TFTP

Backup

Startup configuration or running configuration files can be stored on a TFTP (Trivial File Transfer Protocol) server and can be restored in the event of the problem. The configuration file should also be included in the network documentation. To save the running configuration or the startup configuration file to a TFTP (Trivial File Transfer Protocol) server, use the copy running-config tftp or copy startup-config tftp command. Following are the steps to back up the running configuration to a TFTP server:

1. Enter the copy running-config tftp command in user exec mode and then enter the hostname or IP  address where the configuration file will be stored.


2. Enter the name to assign to the configuration file.


3. Press Enter to confirm every choice.

The figure below illustrates the backup process to TFTP.

Restoring

To restore the running configuration or the startup configuration from a TFTP (Trivial File Transfer Protocol) server, use copy tftp running-config or copy tftp startup-config command. Following are the steps to restore the running configuration from a TFTP server:

1. Enter the copy tftp running-config command in user exec mode and then enter the host name or IP address where the configuration file is stored.


2. Enter the name to assign to the configuration file.


3. Press Enter to confirms each choice.

The Figure below illustrates the restore process from the TFTP server.

 

Backing Up and Restoring Using a USB

Backup

Before backing up to a USB port, it is important to verify that the USB drive is there and confirm the name of the drive using the show file systems command in the user exec mode. If USB drive is there, use the copy run usbflash0:/ command to copy the configuration file to the USB flash drive. Be sure to use the name of the flash drive exactly, as indicated in the file system. The slash indicates the root directory of the USB flash drive. Then the IOS will prompt for the filename. If the file already copied and exists on the USB flash drive, the router will then prompt to overwrite. We can see files and directories in the USB using dir command.

Restore

To copy the file back, use the command copy usbflash0:/Router-Config running-config to restore a running configuration where Router-Config is the backup file name in the USB.

Defence Against Threats - Management, Firewall, Encryption

In defending against network attack, there are four sets of tools that will help you to keep your network secure against unauthorized access, monitoring, and network attacks:-

• Management


• Firewall


• Encryptions


• End Point Security

Management

The management is the main set of defense against network attacks. The following actions should be implemented as part of configuration management against network attacks.

Backup, Upgrade, Update, and Patch

The machines in the network should be running up-to-date because the latest update can provide more effective defense against network attacks. Whenever new malware is released, the operating systems need the current update with the latest versions of antivirus software. The best way to keep up-to-date against network attacks is to download security updates and patch from the operating system vendor.

The management needs to create central patch server for critical security patches. All other systems must have access from time to time. Any required security patches that are not installed to a host are automatically downloaded from the server and installed automatically user intrusion.

Backup is very important when defending against network attacks. Each computer should have the latest copy of the backup.  All your configuration files in your Operating Systems or Applications should have enough security.

Authentication, Authorization, and Accounting

Authentication, authorization, and accounting (AAA) network security services provide primary access control on a network device. AAA authenticate and control access to a network, its control the users what they can do while they are login.

Passwords

The password is very important to protect network devices against attacks, it is important to use strong passwords rather than using default password or to easy password. For password, implementation follows the below steps.

• Use complex password Including uppercase letters, lowercase letters, numbers, symbols, and spaces, if allowed.


• Use minimum 8 characters password, preferably 10 or more characters.


• Do not use common dictionary words for the password.


• Avoid passwords based on repetition, number sequences, letter sequences, usernames, relative or pet names, misspell words.


• Do not use biographical information, such as birthdates, ID numbers, ancestor names, or other easily identifiable pieces of information.


• Change passwords frequently.


• Do not write passwords down and leave them in clear places.


• Following are the examples of passwords

Weak Password

• Pakistan


• Yasir


• Nokia


• Khan1975


• 1234567

Strong Password

• P@12>fo<ur^1978


• No ^^&34@fsc^hub

On Cisco routers and switches, leading spaces are ignored for passwords, but spaces after the first character are the part of the passwords. The password which uses the space bar and creates a phrase made of many words which are called a passphrase.

Firewalls

A firewall is the most efficient security tools for protecting users from network attacks. The firewalls exist in between two or more networks controlling traffic and prevent unauthorized access between them. Personal firewalls are also installed on end systems. Following are different techniques which use a firewall for filtering:

• URL filtering - Prevents or allows access to websites using Keywords or URLs. Packet filtering – Uses MAC address or IP address to prevent or allows access.


• Application filtering - Prevents or allows access by specific application types.


• State full packet inspection (SPI) - Incoming packets must be valid responses from internal hosts. Voluntary packets are blocked unless permitted particularly. SPI also recognize and filter specific types of attacks.

Encryption

Encryption is used in defense against network attacks. It can give protection against eavesdropping and sniffer attacks. Internet Protocol Security (IPSec), Private Key Infrastructure (PKI),  and Virtual Private Networks (VPN) can secure a network against attacks.

Endpoint Security

Individual computer (host) system or device that acts as a network client. Common endpoints are laptops, desktops, servers, smartphones, and tablets. Securing and preventing these devices from network attack is the most challenging task for a network administrator. For securing endpoint must have well-documented policies, and the employees must be aware of these rules. The employees must be trained for proper using the network. The policies must include the use of antivirus software and host intrusion prevention.