Monitoring and Managing

• Know your network is doing well.
• Understand the trends in your network performance.
• Identify your bottlenecks and propose solutions.
• Proact – Don’t react.

Phases of optimizations and the tools

1. Create a baseline – Netflow, NBAR, IP SLA
2. Optimize Network – QoS, AutoQoS VoIP, AutoQoS Enterprise
3. Measure / Adjust – Netflow, NBAR, IP SLA, Syslog
4. Deploy Apps – Netflow, NBAR

• https://en.wikipedia.org/wiki/NetFlow
• Cisco NBAR
• WhitePaper AutoQoS
• Cisco IP SLA

(more…)

• Wireless Signal Mesured in dBm ( Power referenced against one Milliwatt )
• Range is roughly -30dBm to -90dBm
  • -30dBm = Max Achievable ( not desired ).
  • -67dBm = Mininum for real-time Apps.
  • -80dBm = Minimum for communication.
• Noise is always a challenge
• Signal to Noise Ratio ( SNR ) = ( Signal – Noise ) = Value
  • Mininum SNR of 25 is needed for real-time apps.

(more…)

Unicast vs Multicast

• Routed via PIM ( Protocol Independent Multicast ).
• Always UDP-Based ( Video, Audiostreams, some kinds of data ).
• Typical network challenges ( QoS, Security, Bandwidth consumption).
• Began as a ‘speciality’ technology, becoming heavily adopted in modern times.

Multicast Addresses

• Multicast group members receive all data center to a group.
• Multicast IPv4 Range: [ 224.0.0.0  239.255.255.255 ]
  • Filtering tip:
    • Last 23 bits of IP mapped to MAC
      • Can lead to overlapping addresses

(more…)

Remote Access VPN design

• For a VPN you need a termination device (vpn concentrator / Firewall), a client and the connecting technology for tunneling.
• Cisco Easy VPN.
• Client options
  • IPSEC VPN client
  • SSLVPN Clientless Access
  • SSLVPN Thin client
  • SSLVPN Thick client

Placement of the VPN Termination Device:

(more…)

Core layer

• Cisco 6509.
• Static routing used to ISP ( or basic BGP ).
• FWSM or ACE module used as initial filter.
• Static route down to VIP of aggregation layer FHRP.

Aggregation Layer

• Cisco 6506 ( MSFC ).
• Traffic received from core routed to CSM
  
• CSM load balances to VLANs at the access layer
• Simple Design allows inter-vlan routering ( web, app, db )
  • Inter-vlan routing without a FWSM can lead to access from the VLANs.

Access Layer

• Cisco 6509
• Servers typically devided into web, app, and database VLANS.
• Server gateways set to CSM, FWSM, or VIP of the FHRP on L3.
• Firewall restrictions between layers common.

A design that must stay up

• Public face of an organization
• The place where downtime is incredibily harmful
• The place where budgets are approved\

Ultra Redundant, Ultra secure Firewall Design

• Only Method through layers is via servers
• Option of using different firewall vendors at different layers
• Supports virtual firewall using FWSM (Firewall Services Module) or ACE (Application controle engine) module

(more…)

(more…)

• Unicast:  One-to-one.
• Multicast: One-to-many.
• Anycast: One-to-closest.

• Link-local scope address:  layer2 domain
• Unique / Site-local scope address: Organization
• Global scope address: Internet

(more…)

STP in the datacenter

STP logical interfaces maximum

• RSTP / MST reach topology maximus. Switch specs logical / virtual interfaces.  (6500/ 6748)
  • Logical interfaces == ((trunk ports * vlans ) + non-trunk interfaces)
  • Virtual interfaces ( Per line card ) = (( trunk ports * vlans ))
  • verify with ‘show spantree sum total‘

Example logical interfaces:

6500 Chassis:

• 120 VLANS
• 49 Access layer switches
• 2 connections to each switch ( double uplink but with etherchannel counts as 1 logical interface )
• 1 Cross Connect to secondary Agg Switch.
• 30 other devices connected
  • (( 120 * 50 ) + 30 ) = 6030 Logical interface (out of 10,000 max)

Example Virtual interfaces:

Cisco 6748 Linecard

• 120 VLANS
• 12 Access layer switches, 4 Etherchannel-bundled connections.
  • 12 x 4 = 48 ports  ( Virtual interfaces counts every interface )
    • ( 120 * 48 ) = 5760 Virtual Interfaces (out of 1800 max)

High Availability

Nic teaming options

• Adapter fault tolerance (AFT):  active / standby  – Two nics  One switch
• Switch fault tolerance (SFT):  active / standby  – Two nics Two switches
• Adaptive Load Balancing (ALB):  active / active – One IP Two Macs
• Etherchannel – LAG

Expectations and Failover Timers