DHCP Snooping — Rogue Servers & the Binding Table
The switch becomes an active DHCP referee: untrusted ports (all by default) may send Discover/Request; Offers and ACKs only come from trusted ports. Rogue DHCP server on a desk switch simply gets its replies dropped. ip dhcp snooping ip dhcp snooping vlan 10,20 interface Gi1/0/24 ip dhcp snooping trust ! optional armour: ip dhcp snooping […]
Port Security — Sticky MACs & Violation Modes
Per access port: learn/limit MACs, act on violations. Default violation mode is shutdown (err-disable); protect drops silently, restrict drops and logs. interface Gi1/0/1 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation shutdown switchport port-security aging time 10 type inactivity Sticky converts learned MACs into config — survives […]
ACL Design & Troubleshooting — Placement, Order, Counters
Design law: extended near the source, standard near the destination — stop unwanted traffic before it crosses the network. Named ACLs with sequence numbers for editable production lists; least privilege; no accidental permit ip any any. Types: standard = source only; extended = proto + src/dst + ports; time-range ACLs for business-hours rules; prefix-lists/route-maps when […]
Routing Protocol Authentication & Passive Interfaces
If routing updates are unauthenticated, anyone on-path can inject a better route. Per-interface (IGP) or per-session (BGP) authentication fixes it — and a mismatch simply means no adjacency, which is also how you spot a partially-broken design. ! EIGRP key chain AUTH key 1 key-string cisco123 interface Gi0/0 ip authentication mode eigrp 100 md5 ip […]
RADIUS — UDP AAA for Access & Accounting
Centralised AAA over UDP: authentication 1812, accounting 1813 (legacy 1645/1646). Only the password field is encrypted — headers and attributes travel in the clear, which is the core difference to TACACS+. Flow: Access-Request → Access-Accept/Reject/Challenge; authorization returns attributes (VLAN, ACL, session timeout); accounting sends start/stop/interim updates. The protocol of 802.1X and wireless (ISE downstream) — […]
Local AAA — Users, Method Lists & Lockout Traps
AAA = who are you (Authentication), what may you do (Authorization), what did you do (Accounting) — all three served locally from the router’s own user database when no AAA server exists. username admin privilege 15 secret Str0ngP@ss ip domain-name example.com crypto key generate rsa modulus 2048 line vty 0 4 transport input ssh login […]
Cloud Service & Deployment Models — IaaS, PaaS, SaaS
The service models are just a sliding scale of who patches what: Model Provider runs You run Examples IaaS hardware, DC, virtualisation OS, patches, apps, data EC2, Azure VM, GCE PaaS + OS/runtime/middleware app + data App Service, Cloud Run SaaS everything incl. the app users, data, config mail, CRM Shared responsibility: you always keep […]
IPsec — ESP, IKE & Tunnel Mode
Layer 3 crypto suite: ESP (protocol 50) encrypts+authenticates — AH (51, auth only) is legacy; “see IPsec, think ESP”. Two phases Phase 1 (IKE, UDP 500): negotiate encryption/hash/DH group/auth (PSK or certs) → IKE SA. Diffie-Hellman shares a secret without ever sending it (that’s the mod-p exponentiation trick). Phase 2: negotiate ESP transform-set, lifetimes → […]
VPN Types — Site-to-Site, Remote Access, GRE, NAT-T
Site-to-site: router↔router, permanent tunnel between offices. Remote access: client↔gateway, often SSL/TLS. GRE over IPsec when you need routing protocols or multicast that plain policy-based IPsec won’t carry. GRE is not encryption GRE only encapsulates (protocol 47) — readable payload, no integrity, no auth. “GRE tunnel over the internet” = exposed data. GRE’s value: multicast + […]
WAN Technologies — From Leased Lines to SD-WAN
Topologies: point-to-point (simple, costly), hub-and-spoke (cheap, hub = SPOF), full/partial mesh. Legacy still in syllabus as concepts: circuit-switched (PSTN/ISDN) and packet-switched (Frame Relay, ATM) — know the idea, not the config. Leased line: dedicated, constant bandwidth, encapsulation HDLC (Cisco default) or PPP (standard, CHAP/PAP, multilink). Ethernet WAN: Metro-Ethernet — E-Line (P2P), E-LAN (multipoint); feels like […]