DHCP Snooping — Rogue Servers & the Binding Table
The switch becomes an active DHCP referee: untrusted ports (all by default) may send Discover/Request; Offers and ACKs only come from trusted ports. Rogue DHCP server on a desk switch simply gets its replies dropped. ip dhcp snooping ip dhcp snooping vlan 10,20 interface Gi1/0/24 ip dhcp snooping trust ! optional armour: ip dhcp snooping […]
ACL Design & Troubleshooting — Placement, Order, Counters
Design law: extended near the source, standard near the destination — stop unwanted traffic before it crosses the network. Named ACLs with sequence numbers for editable production lists; least privilege; no accidental permit ip any any. Types: standard = source only; extended = proto + src/dst + ports; time-range ACLs for business-hours rules; prefix-lists/route-maps when […]
Routing Protocol Authentication & Passive Interfaces
If routing updates are unauthenticated, anyone on-path can inject a better route. Per-interface (IGP) or per-session (BGP) authentication fixes it — and a mismatch simply means no adjacency, which is also how you spot a partially-broken design. ! EIGRP key chain AUTH key 1 key-string cisco123 interface Gi0/0 ip authentication mode eigrp 100 md5 ip […]
CoPP — Protecting the CPU That Protects Everything
Packets destined to the router (OSPF, BGP, SSH, SNMP, ARP, ICMP-to-interface) get punted to the CPU. Without protection, one ICMP flood overloads the CPU, adjacencies flap — data plane healthy, network dead. CoPP rate-limits the punts. Only protects traffic addressed to the device. Transit traffic is not CoPP’s job. Implements as plain MQC: named ACLs […]
TACACS+ — Encrypted, Separated AAA for Device Admin
Cisco’s device-administration AAA protocol: TCP 49, entire payload encrypted, and the three A’s are separate decisions — you can authenticate via TACACS+ while authorising commands elsewhere. That command-level authorization is why ENCOR prefers it for CLI access. aaa new-model tacacs server TAC1 address ipv4 10.10.10.20 key cisco123 aaa authentication login default group tacacs+ local aaa […]
RADIUS — UDP AAA for Access & Accounting
Centralised AAA over UDP: authentication 1812, accounting 1813 (legacy 1645/1646). Only the password field is encrypted — headers and attributes travel in the clear, which is the core difference to TACACS+. Flow: Access-Request → Access-Accept/Reject/Challenge; authorization returns attributes (VLAN, ACL, session timeout); accounting sends start/stop/interim updates. The protocol of 802.1X and wireless (ISE downstream) — […]
Local AAA — Users, Method Lists & Lockout Traps
AAA = who are you (Authentication), what may you do (Authorization), what did you do (Accounting) — all three served locally from the router’s own user database when no AAA server exists. username admin privilege 15 secret Str0ngP@ss ip domain-name example.com crypto key generate rsa modulus 2048 line vty 0 4 transport input ssh login […]
Cloud Service & Deployment Models — IaaS, PaaS, SaaS
The service models are just a sliding scale of who patches what: Model Provider runs You run Examples IaaS hardware, DC, virtualisation OS, patches, apps, data EC2, Azure VM, GCE PaaS + OS/runtime/middleware app + data App Service, Cloud Run SaaS everything incl. the app users, data, config mail, CRM Shared responsibility: you always keep […]
Overlay VPNs — DMVPN & FlexVPN
Three generations of Cisco multipoint VPN, all built from the same bricks (mGRE + IPsec + a smart control plane): DMVPN mGRE one interface, infinite spokes; NHRP maps tunnel IPs to real WAN IPs; IPsec encrypts per-tunnel via tunnel protection ipsec profile. Phase 1 hub-and-spoke, phase 2 spoke-to-spoke on demand, phase 3 NHRP redirect/shortcut — […]
IPsec — ESP, IKE & Tunnel Mode
Layer 3 crypto suite: ESP (protocol 50) encrypts+authenticates — AH (51, auth only) is legacy; “see IPsec, think ESP”. Two phases Phase 1 (IKE, UDP 500): negotiate encryption/hash/DH group/auth (PSK or certs) → IKE SA. Diffie-Hellman shares a secret without ever sending it (that’s the mod-p exponentiation trick). Phase 2: negotiate ESP transform-set, lifetimes → […]