Ccna

Introduction

When a site is implementing new router connectivity, it is useful to work from a configuration template to enhance productivity. This is particularly important in large-scale Frame Relay networks because auditing and altering router configurations to obtain consistency between hundreds of routers can be very tedious and time-consuming.

It is also useful for established sites to occasionally audit their router configurations to verify they are configured consistently, and that they are making best use of management and security features on the routers.

IPsec Security Association Choices

The previous article did not have space to cover some basic choices you have to make when deciding how to run IPsec.

One of the choices is whether you wish to use the Authentication Header (AH) or Encapsulating Security Payload (ESP). Each of these is an IP protocol, just as TCP and UDP are. The protocol codes are 51 and 50, for AH and ESP respectively. Thus IPsec packets will normally have 50 or 51 in the IP protocol field, and there will be an AH or ESP header between the IP header and the payload data.

/home/nfcuser — user created to drive NetFlow Analyzer, user working directory

configs — router configs for NFA use (it’s not happy with them)
exports — directory, sym link to directory where NFA drops exported CSV files. Don’t delete!
images — directory to dump screen capture GIF/JPEG saves into

/opt/CSCOnfa — Cisco Flow Data Analyzer

check.All — script to check Java, DisplayServer, UtilityServer are running
start.All — script to start DisplayServer, UtilityServer
stop.All — stops themcisco — mojo (ASN.1/SNMP toolset) — not for user use

NFADisplay — NFA Display UI

bin — programs, scripts, also *.class = Java classes

start.Display script — starts NFA Display screen (UI)

helpRuntimeJava

RuntimeJavaWin95

NFAServer — NFA DisplayServer (Display talks to)

AliasDefn — known AS’s, ports, protocols

[not well documented: see perhaps the UsePortText flag in the NFADS.resources file]

bin — programs, scripts

check.DisplayServer — script to check DisplayServer
DisplayServer — program
NFADS.resources — options for DisplayServer, MaxMB, UsePortText
start.DisplayServer — starts just DisplayServer
stop.DisplayServer — stops it

Cache — cached infoexported_files — where exported CSV files go, /home/nfcuser/exports sym link to this

logs — misc log files (server)

RouterGroup — tree file sets and router groups

util — utilities

mgmt_NFC.exp — expect script (is expect installed?).Appears to copy specified collected info to another directory. Looking at the script, from another machine. Probably used behind the scenes to bring in data from another DisplayServer.

NFAUtility — NFA UtilityServer (does all backend dirty work, talks to NFCGW)

bin — scripts, programs, Java classes

check.UtilityServer
start.UtilityServer
stop.UtilityServer

config — config files for UtilityServer

HostPreferences.txt — address à name translation
NFCCC.txt — NetFlow collectors and userid and port
RouterConfig.txt — address, SNMP community, tms/netflow

Conjecture when NFA looks at directory of router configs, it populates this file. (Not very documented?)

data — AS.txt_0, HostAliases.txt — purpose not clear, probably not user fileslogs — log files for UtilityServer

NFAU.log — log file

state — directory to hold .pid file for UtilityServeroriginals — directory of original config/script files (install probably put locations of things into them)

/opt/CSCOnfc — Cisco FlowCollector

What is a VPN?

A Virtual Private Network or VPN is a network implemented using a shared network infrastructure but so as to provide the security and privacy of a private leased-line network. Older examples would be Frame Relay and ATM. Lately, VPN has come to more often refer to IPSec tunnels over the Internet, or perhaps PPTP or L2TP dial VPN connectivity across a shared internetwork.

For our purposes in this article, the VPNs will be IP networks where the WAN core of a corporate network has been outsourced to a Service Provider. The IP VPN connectivity is provided across a shared IP network belonging to the Service Provider. It will turn out the BGP and MPLS-based VPNs we will talk about are powerful enough to provide secure connectivity (and relatively simple configuration) for both intranets and extranets.

What is SMDS?

Switched Multimegabit Data Service (SMDS) is a high-speed, connectionless, low-delay, packet switched, networking service that operates over public data networks. Think Frame Relay on steroids.

Bellcore developed the specifications for SMDS due to the demand for wide-area networking with LAN-like characteristics. (Pete comment: And some of us think it was a way to experiment with pre-ATM ATM-like data transport, anticipating an ISDN-like 15-year rollout of ATM).