Index

Numbers

2.4 GHz band, 485

3DES (Triple DES), 447

5 GHz band, 486

802.1D STP, 36, 79

port states, 37

port types, 37

802.1Q standard, 13

802.1x, 727–729

A

AAA (Authentication, Authorization, and Accounting), 770–771

configuring for network device access control, 773–776

RADIUS, 772–773

TACACS+, 771–772

verifying, 776

ABRs (area border routers), 197–199

absolute power values, 491–492

decibel (dB), 492–494

absolute-timeout command, 770

access layer, 599–600

Layer 2, 606–607

Layer 3, 607

access ports, 11

configuring, 11–12

ACLs (access control lists), 749–750

BGP network selection, 292–293

configuring for CoPP, 785

controlling access to vty lines, 764–765

extended, 292

IGP network selection, 292

named, 752–753

numbered, 750–751

numbered extended, 751–752

PACLs, 753–754

AS Path ACL filtering, 305–306

standard, 291–292

VACLs, 754–755

Active state, 250

AD (administrative distance), 131–132

address families, 244

address-family unicast command, 228

addressing. See also NAT (Network Address Translation)

multicast, 332

administratively scoped block, 333

GLOP block, 333

IGMP, 335–336

IGMP snooping, 337–339

IGMPv2, 335

IGMPv3, 337

internetwork control block, 332

Layer 2, 333–335

local network control block, 332

SSM block, 333

well-known reserved addresses, 333

adjacencies

debugging, 656–662

requirements for, 175

verification of, 179–180

adjacency table, 28

Adj-RIB-In table, 257

Adj-RIB-Out table, 257–258, 260

administratively scoped block, 333

advanced configurations, LACP

interface priority, 116

LACP fast, 113

maximum number of port-channel member interfaces, 114–115

minimum number of port-channel member interfaces, 113–114

system priority, 115–116

B

backbone, 167

backward compatibility, EIGRP metrics, 157

bandwidth, 487–488

bandwidth command, 441

bare-metal servers, 794

base-10 logarithm function, 492

basic BGP configuration, 251–253

Bc (Committed Burst Size), 379

BDR (backup designated router), 170–172

beamwidth, 529–530

best-effort service, 375

best-path algorithm, 315–316

AIGP, 317–318

eBGP over iBGP, 321

LOCAL_PREF attribute, 316–317

lowest IGP metric, 321

lowest neighbor address, 323

MED attribute, 320–321

minimum cluster list length, 322

origin type, 319–320

prefer the oldest eBGP path, 322

router ID, 322

shortest AS path, 318–319

weight attribute, 316

BGP (Border Gateway Protocol), 128, 240. See also BGP multihoming

address families, 244

ASNs, 242–243

attributes, AS_Path, 243

basic configuration, 251–253

conditional matching, multiple conditions, 299

dynamic route summarization, 264

eBGP sessions, 247

fields, 259

iBGP sessions, 245–247

inter-router communication, 244–245

IPv6 configuration, 274–278

IPv6 summarization, 278–280

loop prevention, 243–244

messages, 247–248

neighbor states, 248–249

Active, 250

Connect, 250

Established, 251

Idle, 249

OpenConfirm, 251

OpenSent, 250–251

neighbors, 245

network statement, 255–256

PAs, 244

path attributes, 243

AS_SET, 270–273

prefix advertisement, 255–257

route advertisements from indirect sources, 261–263

route aggregation, 264–269

with AS_SET, 270–273

atomic aggregate, 269–270

route summarization, 263–264

sessions, 245

verifying, 253–255

summary fields, 253

tables, 257–260

viewing, 276–277

BGP multihoming, 287

best-path algorithm, 315–316

AIGP, 317–318

eBGP over iBGP, 321

LOCAL_PREF attribute, 316–317

lowest IGP metric, 321

lowest neighbor address, 323

MED attribute, 320–321

minimum cluster list length, 322

origin type, 319–320

prefer the oldest eBGP path, 322

router ID, 322

shortest AS path, 318–319

weight attribute, 316

branch transit routing, 289–290

clearing BGP connections, 308–309

communities, 309

conditionally matching, 310–312

enabling support, 310

extended, 309

private, 309, 312–313

well-known, 309

conditional matching, 298–299

ACLs, 291–293

complex matching, 299–300

continue keyword, 301

distribute list filtering, 303–304

optional actions, 300–301

AS Path ACL filtering, 305–306

prefix list filtering, 304–305

prefix lists, 295–296

prefix matching, 293–295

regular expressions, 296–297

route filtering, 301–303

route maps, 297–298, 306–308

set actions, 300–301

deterministic routing, 289

Internet transit routing, 288–289

path selection, using longest match, 314–315

resiliency in service providers, 287–288

blocked designated switch ports, modifying location, 61–63

blocking port, 37

BPDU filter, 70–71

BPDU guard, 67–70

BPDUs (bridge protocol data units), 38

branch security, 708

branch transit routing, 289–290

broadcast domains, 6

broadcast networks, 188

broadcast traffic, 6

BSR (bootstrap router), 356–357

BSS (basic service set), 521, 560

BSS (business support system), 801

C

CAM (content addressable memory), 16

campus design, 607–609

security, 708

candidate RPs, 355, 357

CAPWAP, 521

carrier signals, 501–503

CCKM (Cisco Centralized Key Management), 547

CEF (Cisco Express Forwarding), 25–26

hardware, 29

software, 28–29

Central Web Authentication, 572

centralized forwarding, 27

centralized wireless topology, 516–517

channels, 487

checkpointing, 29–30

Chef, 868–873

CIR (Committed Information Rate), 379

Cisco AnyConnect, 714–715

Cisco DevNet, 841–842

Community page, 843

Discover page, 842

Events page, 844

Support page, 843

Technologies page, 842

Cisco DNA Center Assurance, 696

Client 360 page, 699–703

main page, 691–698

search page, 698–699

Cisco ENFV (Enterprise Network Functions Virtualization), 807–808

MANO, 808–810

VNFs and applications, 810

x86 hosting platforms, 812

Cisco FlexVPN, 456

Cisco IBNS (Identity-Based Networking Service), 735

Cisco IOS

password types, 757

privilege levels, 761–764

Cisco ISE (Identity Services Engine), 725–727

Cisco SAFE, 708, 710–711

Cisco SD-WAN, 632. See also SD-WAN

architecture, 633–634

Cloud OnRamp, 636

for IaaS, 639

for SaaS, 636

routers, 634–635

Cisco Stealthwatch, 722–723

Cloud, 724–725

Enterprise, 723–724

Cisco Threat Grid, 712–713

Cisco Umbrella, 715

class maps, configuring for CoPP, 785

Class Selector PHB, 372

classic metrics, 154–155

classification, Layer 7, 369

clear ip bgp command, 308

clearing

BGP connections, 308–309

NAT translations on pooled NAT, 429

CLI (command-line interface), 818–819

client requests, 95

Cloud OnRamp, 636

for IaaS, 639

for SaaS, 636–639

cloud security, 709

collision domains, 5–7

CSMA/CD, 5

show vlan, 8–9

commands

absolute-timeout, 770

address-family unicast, 228

aggregate-address, 267, 270

area filter-list, 219

auto-cost reference-bandwidth, 182

bandwidth, 441

clear ip bgp, 308

crypto ipsec profile, 459

crypto isakmp policy, 457

crypto map, 458

default-information originate, 181

distribute-list, 221

exec-timeout, 770

interface tunnel, 441

interface vlan, 22

ip access-list standard, 291

ip address secondary, 21

ip mtu, 441

ip nat outside, 421

ip ospf, 174

ip ospf cost, 182

ip prefix list, 295

ip route, 135

ipv6 prefix list, 295

ipv6 unicast routing, 142

keepalive, 441

keywords, 14

lacp max-bundle, 114–115

lacp port-priority, 116

lacp system-priority, 115–116

mac address-table static mac-address vlan, 16

maximum-paths, 212

neighbor route-map, 306

network area, 172

no switchport, 22

ntp master, 397

ntp peer, 400

ospfv3 ipv4, 235

ospfv3 network, 235

passive, 174

ping, 645–650

port-channel min-links, 113–114

privilege levels, 761–764

route-map, 297

router ospfv3, 228

sdm prefer, 30

show bgp, 258

show bgp ipv4 unicast summary, 260

show bgp ipv6 unicast summary, 276

show bgp summary, 253

show etherchannel port, 108–110

show etherchannel summary, 106–107

show glbp, 416–417

show glbp brief, 414

show interface status, 17–18

show interface tunnel, 443

show interfaces switchport, 16–17

show interfaces trunk, 12–13, 100–101

show ip nat translations, 422, 426

show ip ospf database summary, 207

show ip ospf interface brief, 184

show ip ospf neighbor, 231

show ip route ospf, 180

show ipv6 interface, 24

show ipv6 route ospf, 232

show lacp counters, 112

show lacp neighbor, 111

show mac address-table dynamic, 14–16

show ntp associations, 398–399

show ntp status, 397

show ospfv3 interface, 231–232

show ospfv3 interface brief, 232

show pagp counters, 112

show pagp neighbor, 111

show sdm prefer, 31

show spanning-tree, 83–84

show spanning-tree interface, 46–47

show spanning-tree mst, 84–85

show spanning-tree mst configuration, 83

show spanning-tree root, 40–41, 43

show spanning-tree vlan, 59–60, 62–64

show standby, 407

show track, 402–403

show udld neighbors, 73–74

show vrrp, 410, 412

show vtp status, 97–98

spanning-tree mode mst, 82

spanning-tree portfast, 66

standby track decrement, 408

switchport access, 11

switchport mode access, 11

switchport mode trunk, 12

switchport negotiate, 101

switchport trunk allowed, 14

switchport trunk native vlan, 13

traceroute, 650

track ip route reachability, 402

tunnel destination, 441

tunnel protection, 459

vlan, 8

vtp domain, 96

communication

OSPFv3, 227–228

VTP, 95

communities (BGP), 309

conditionally matching, 310–312

enabling support, 310

extended, 309

private, 309, 312–313

well-known, 309

comparison of IKEv1 and IKEv2, 452–453

complex conditional matching, 299–300

components, EtherChannel, 103

conditional debugging, 662–665

conditional matching, 298–299

ACLs

extended, 292

standard, 291–292

BGP communities, 310–312

complex matching, 299–300

continue keyword, 301

distribute list filtering, 303–304

GLBP, 413–414

multiple conditions, 299

optional actions, 300–301

AS Path ACL filtering, 305–306

prefix list filtering, 304–305

prefix lists, 295–296

prefix matching, 293–295

regular expressions, 296–297

route filtering, 301–303

route maps, 297–298, 306–308

set actions, 300–301

configuring

access ports, 11–12

BGP, 251–253

DTP, 100

EtherChannel, 105–106

GRE tunnels, 440–442

hierarchical VRRP, 411–412

legacy VRRP, 410–411

MST, 82

NTP, 397–398

peers, 400

OSPF, 176–177

interarea summarization, 215–217

interface-specific, 174

network statement, 172–174

OSPFv3, 228–231

PAT, 429–430

pooled NAT, 426–427

routed switch ports, 23

trunk ports, 12

VTP, 95–96

ZBFW, 778–784

Connect state, 250

containers, 796–797

continue keyword, 301

control messages, 345

control plane

LISP, 466

SD-Access, 619–620

convergence, EIGRP, 159–161

CoPP (Control Plane Policing), 784

applying the policy map, 786

configuring ACLs for, 785

configuring class maps for, 785

configuring policy map for, 786

verifying, 787–789

core layer, 601–602

creating

SVIs, 22

VLANs, 8

on VTP domain server, 97–98

VRF instances, 144–145

crypto ipsec profile command, 459

crypto isakmp policy command, 457

crypto map command, 458

crypto maps, 457

CSMA/CD (Carrier Sense Multiple Access/Collision Detect), 5–6

CST (Common Spanning Tree), 79–80

cty lines, 756

CWA (Centralized Web Authentication), 734–735

D

data center, security, 708

data link layer, 4

data models, YANG, 834–836

data path, LISP

PETR, 471–472

PITR, 472–473

data plane

LISP, 467–476

SD-Access, 620–621

dBd (dB-dipole), 496

dBm (dB-milliwatt), 494–495

dead interval timer, 183

debugging

adjacencies, 656–662

conditional, 662–665

decibel (dB), 492–494

computing with simple rules, 494

de-encapsulation, 439

Default Forwarding PHB, 373

default route advertisement, OSPF, 181–182

default zone, 777–778

default-information originate command, 181

DEI (Drop Eligible Indicator) field, 7

DEI field, 371

delay variation, 365–366

demodulation, 502

DES (Data Encryption Standard), 447

deterministic routing, 289

devices

hardening, 789–790

locating in a wireless network, 552–555

DevNet, 841–842

Community page, 843

Discover page, 842

Events page, 844

Support page, 843

Technologies page, 842

DFZ (default-free zone), 464

DH (Diffie-Hellman), 448

DiffServ model, 367–368

Dijkstra algorithm, 128, 166, 226

directional antennas, 534–537

directly attached static routes, 135–136

disabling, trunk port negotiation, 101

discontiguous networks, OSPF, 209–210

discovering WLCs, 523

displaying

BGP tables, 258

interface status, 17–18

MAC address table, 14–16

switch port status, 16–17

distance vector routing protocols, 126

distribute lists, 220–222

route filtering, 303–304

distributed forwarding, 27

distribute-list command, 221

distribution layer, 600–601

DMVPN (Cisco Dynamic Multipoint VPN), 455

downstream, 344

DP (designated port), 37

DR (designated router), 170–172, 183–184, 186–187

elections, 184

placement, 185–186

DROTHER, 179

DRS (dynamic rate shifting), 508–510

DSCP (Differentiated Services Code Point) per-hop behaviors, 372

Assured Forwarding, 373–374

Class Selector, 372

with decimal and binary equivalents, 375

Default Forwarding, 373

Expedited Forwarding, 374–375

DSSS (Direct sequence spread spectrum), 503

DTP (Dynamic Trunking Protocol), 99–100

configuring, 100

disabling trunk port negotiation, 101

verifying, 100–101

DUAL (diffuse update algorithm), 127, 150–151

Dynamic Link Aggregation Protocols

LACP, 110–112

interface priority, 116

LACP fast, 113

maximum number of port-channel member interfaces, 114–115

minimum number of port-channel member interfaces, 113–114

port modes, 104–105

system priority, 115–116

viewing neighbor information, 111

PAgP, 111–112

port modes, 104

dynamic routing protocols. See routing protocols

E

E plane, 527

EAP (Extensible Authentication Protocol), 563–565, 729–732

configuring with external RADIUS servers, 566–568

configuring with Local EAP, 568–571

verifying configuration, 571

eBGP (exterior BGP) sessions, 125, 246–247

EEM (Embedded Event Manager), 858–859

applets, 859–863

and Tcl scripts, 863–865

EGPs (Exterior Gateway Protocols), 125

EIGRP (Enhanced Interior Gateway Routing Protocol), 127, 148

AS, 151

convergence, 159–161

DUAL, 150–151

failure detection, 159

FD, 152, 158

feasibility condition, 152

feasible successors, 152

K values, 154

load balancing, 157–158

metrics, 154–156

backward compatibility, 157

classic, 154–155

wide, 156–157

neighbors, 154

RD, 152

route summarization, 161–162

successor routes, 152

successors, 152

timers, 159

topology table, 153–154

unequal-cost load balancing, 158

variance multiplier, 157

EIRP (effective isotropic radiated power), 496

electromagnetic waves, 483

embedded wireless networks, 518

EMs (element managers), 801

enabling, BGP community support, 310

encapsulation, 439

encryption

IPsec supported methods, 447–448

password, 757–758

endpoints, 711

ENFV (Enterprise Network Functions Virtualization), 807–808

MANO, 808–810

VNFs and applications, 810

x86 hosting platforms, 812

enhanced distance vector routing protocols, 127

enterprise network architecture

hierarchical LAN design, 596–598

access layer, 599–600

core layer, 601–602

distribution layer, 600–601

Layer 2 access layer, 606–607

Layer 3 access layer, 607

SD-Access design, 610

simplified campus design, 607–609

three-tier design, 604–605

two-tier design, 602–604

equal cost multipathing, 132–133, 157

OSPF, 212

Error Recovery, 69

ERSPAN (encapsulated remote SPAN), 690–692

ESA (Cisco Email Security Appliance), 718–719

ESP (Encapsulating Security Payload), 446–448

Established state, 251

EtherChannel, 101–102. See also Dynamic Link Aggregation Protocols

components, 103

configuring, 105–106

load balancing traffic, 117–118

logical interface status fields, 107

member interface status fields, 107–108

member interfaces, 102

neighbors, viewing, 108–110

PAgP, 105

static, 105

troubleshooting, 116–117

verifying, packets, 111

verifying port-channel status, 106

viewing port-channel interface status, 108

Ethernet

broadcast domains, 6

CSMA/CD, 5

MAC addresses, 4

exam, final preparation for, 890–894

exchanges, 452

EXEC timeout, 770

exec-timeout command, 770

Expedited Forwarding PHB, 374–375

extended ACLs (access control lists), 292

extended BGP communities, 309

F

fabric technologies, 612

SD-Access, 612, 615–616

Cisco DNA Assurance workflow, 631–632

Cisco DNA design workflow, 628–629

Cisco DNA policy workflow, 629–630

Cisco DNA provision workflow, 630–631

components, 616

control plane, 619–620

controller layer, 626–628

fabric border nodes, 624

fabric control plane node, 624

fabric data plane, 620–621

fabric edge nodes, 623–624

fabric policy plane, 621–622

fabric roles and components, 622–623

fabric WLC, 624–625

management layer, 628

network layer, 617–618

overlay network, 619

physical layer, 617

technologies used in, 626

underlay network, 618–619

SD-WAN, 612, 632–633

architecture, 633–634

vAnalytics, 636

vBond Orchestrator, 635

vManage NMS, 634

vSmart controllers, 634

failure detection, 159

OSPF, 183

fast switching, 25

FD (feasible distance), 152, 158

feasibility condition, 152

feasible successors, 152

FHR (first hop router), 344

FHRP (First-Hop Redundancy Protocol), 401–402

object tracking, 402–404

FIB (forwarding information base), 28, 130

fields

BGP tables, 259

IGMP packets, 335–336

OSPF packets, 169

file dispositions, 713

final preparation for the exam, 890–894

FlexAuth, 735

Flexible NetFlow, 678–684

FLexVPN, 456

floating static routes, 138–140

FMC (Cisco Firepower Management Center), 722

forward delay, 38

forwarding architectures, 25

CEF, 26

centralized forwarding, 27

distributed forwarding, 27

SDM templates, 30–31

software CEF, 28–29

stateful switchover, 29–30

free space path loss, 497–499

frequency, 484–488

2.4 GHz band, 485

5 GHz band, 486

bandwidth, 487–488

channels, 487

non-overlapping channel spacing, 488

radio, 485

ranges, 485

unit names, 485

fully specified static routes, 137–138

functions, 852

G

gain, 526, 529

GET (Cisco Group Encrypted Transport) VPN, 455

GitHub, 844–846

basic Python components and scripts, 846–853

functions, 852

GLBP (Global Load Balancing Protocol), 413

configuring, 413–414

load balancing methods, 416

roles, 413

viewing status of, 414–415

weighted load balancing, verifying, 416–417

GLOP block, 333

GRE (Generic Routing Encapsulation), 439

configuration, 440–442

encapsulation, 439

encapsulation overhead, 442

site-to-site over IPsec, 457–462

verifying, 443–444

H

H plane, 527

hardware CEF, 29

hello packets, OSPF, 169

hello time, 38

hertz (Hz), 485

hierarchical configuration, viewing status of, 412–413

hierarchical LAN design

access layer, 599–600

core layer, 601–602

distribution layer, 600–601

hierarchical VRRP configuration, 411–412

HSRP (Hot Standby Router Protocol), 404, 409

configuration, 406

linking object tracking to priority, 408

verifying status of, 407–408

versions, 404

VIP gateway instance configuration, 405–406

HTTP status codes, 826

hubs, collision domains, 5–6

hybrid routing protocols, 127

hypervisors, 794–795

I

IANA (Internet Assigned Numbers Authority), 242

multicast addresses, 332

iBGP (internal BGP) sessions, 245–247

idealistic antenna, 484

Idle state, 249

I/G (individual/group) bit, 334

IGMP (Internet Group Management Protocol), 329, 335

packets, 335–336

IGMP snooping, 337–339

IGMPv2, 335–337

IGMPv3, 337

IGPS (Interior Gateway Protocols), 125

IIF (incoming interface), 344

IKE (Internet Key Exchange), 449

IKEv1, 449–452

aggressive mode, 451

versus IKEv2, 452–453

main mode, 450–451

PFS, 451

phases of key negotiation, 450

quick mode, 451

IKEv2

exchanges, 452

versus IKEv1, 452–453

improvements to, 453–454

indirect link failures, 51–52

inside static NAT, 420–423

inter-area routes, 199

interarea routes, 211–212

interarea summarization, 214–217

interface priority, 116

interface STP cost, 39

interface tunnel command, 441

interface vlan command, 22

interface-specific OSPF configuration, 174

Internet transit routing, 288–289

internetwork control block, 332

inter-router communication

BGP, 244–245

OSPF, 168

intra-area routes, 199, 210–211

intracontroller roaming, 545–547

IntServ model, 366

ip access-list standard command, 291

IP address assignment, 20–21, 144–145

to routed subinterfaces, 21–22

to routed switch ports, 22

to switched virtual interfaces, 22

verification, 23–24

ip address secondary command, 21

ip mtu command, 441

ip nat outside command, 421

ip ospf command, 174

ip ospf cost command, 182

ip prefix list command, 295

ip route command, 135

IP SLA, 692–696

IPP (IP Precedence), 371

IPsec, 445

authentication header, 446

ESP, 446–448

IKE, 449

IKEv1, 449–452

aggressive mode, 451

main mode, 450–451

PFS, 451

phases of key negotiation, 450

quick mode, 451

IKEv2

exchanges, 452

improvements to, 453–454

security services, 446

site-to-site configuration, 456

site-to-site VPNs

GRE, 457–462

verifying, 461–462

VTI, 462–464

supported encryption methods, 447–448

transform sets, 448–449

transport mode, 447

tunnel mode, 447

VPNs, 454–455

Cisco FlexVPN, 456

DMVPN, 455

GET VPN, 455

site-to-site, 455

IPv4, 21

address verification, 23–24

OSPFv3 support for, 235–237

IPv6, 20

address verification, 24

BGP configuration, 274–278

OSPFv3 configuration, 229–231

prefix lists, 295–296

route summarization, 234

static routes, 142–143

ipv6 prefix list command, 295

ipv6 unicast routing command, 142

ISAKMP (Internet Security Association Key Management Protocol), 449

ISE (Identity Services Engine), 725–727

isotropic antenna, 495

IST (internal spanning tree), 81

VLAN assignment to, 87

J-K

jitter, 365–366

JSON (JavaScript Object Notation), 825–826

K values, 154

keepalive command, 441

key caching, 547

keywords, 14

continue, 301

show mac address-table dynamic command, 15

show vlan command, 9–11

L

LACP (Link Aggregation Control Protocol), 110–112

advanced configurations

interface priority, 116

LACP fast, 113

maximum number of port-channel member interfaces, 114–115

minimum number of port-channel member interfaces, 113–114

system priority, 115–116

port modes, 104–105

viewing neighbor information, 111

lacp max-bundle command, 114–115

lacp port-priority command, 116

lacp system-priority command, 115–116

latency

delay variation, 365–366

propagation delay, 364–365

serialization delay, 365

Law of 3s, 492–493

Law of 10s, 493

Law of Zero, 492

Layer 2 forwarding, 4–5

access ports, 11

configuring, 11–12

collision domains, 5–7

diagnostic commands, 14

interface status, displaying, 17–18

MAC address table, displaying, 14–16

switch port status, 16–17

troubleshooting, 16

trunk ports, 12

configuring, 12

VLANs, 7–8

allowed, 14

creating, 8

native, 13–14

viewing assignments to port mapping, 8–9

Layer 2 marking, 370

Layer 2 multicast addresses, 333–335

Layer 2 roaming, 547–549

Layer 3 forwarding, 18

IP address assignment, 20–21

to routed subinterfaces, 21–22

to routed switch ports, 22

to switched virtual interfaces, 22

local network forwarding, 19

packet routing, 19–20

verification of IP addresses, 23–24

Layer 3 marking, 371

Layer 3 roaming, 549–551

Layer 7 classification, 369

legacy VRRP configuration, 410–411

leveraging antennas for wireless coverage, 526

LHR (last hop router), 344, 348

lightweight APs, 516–520

line local password authentication, 758–759

line local username and password authentication, 760–761

line protocols, tracking, 402–403

link budget, 496

link costs, optimizations, 182–183

link-state routing protocols, 127–128

LISP (Cisco Location/ID Separation Protocol), 436, 464–465

architecture components, 465–466

control plane, 466

data path, 470–471

PETR, 471–472

PITR, 472–473

data plane, 467–476

map registration and notification, 468–469

map request and reply, 469–470

routing architecture, 466

LLQ (low-latency queueing), 366

load balancing. See also GLBP (Global Load Balancing Protocol)

EIGRP, 157–158

EtherChannel, 117–118

local bridge identifier, 38

local filtering, 220–222

local network control block, 332

local network forwarding, 19

local SPAN, 685–688

LOCAL_PREF attribute, 316–317

locating

blocked designated switch ports, 43–46

devices in a wireless network, 552–555

root ports, 42–43

Loc-RIB table, 257

long mode, 39

longest match, BGP path selection, 314–315

loop guard, 71–72

loopback networks, 189–190

loops, 34, 129, 140–141

BGP, 243–244

LSAs (link-state advertisements), 127–128, 166, 201–202

age and flooding, 202

OSPFv3, 226–227

sequences, 202

Type 1, 202–204

Type 2, 205–206

Type 3, 207–209

LSDB (link-state database), 128, 166

LWA (Local Web Authentication), 733–734

M

MAB (MAC Authentication Bypass), 732–733

MAC (media access control) addresses, 4

OUIs, 5

MAC address table, 5

displaying, 14–16

mac address-table static mac-address vlan command, 16

MACsec, 741–743

maintaining AP-client compatibility, 503–505

MANO (management and orchestration), 801

map registration and notification, LISP, 468–469

markdown, 378–379

marking, 369

Layer 2, 370

Layer 3, 371

single-rate three-color, 382

two-rate three-color, 384–386

MAs (mapping agents), 355–356

max age, 38

maximal-ratio combining, 508

maximizing the AP-client throughput, 508–509

maximum-paths command, 212

MD5 (Message Digest 5), 448

MDT (multicast distribution tree), 330

measuring

power levels along the signal path, 495–497

wavelength, 489–490

MED (multiple-exit discriminator) attribute, 320–321

member interfaces, 102

Meraki SD-WAN, 632

messages, BGP, 247–248

metrics, 132

EIGRP, 154–156

backward compatibility, 157

classic, 154–155

wide, 156–157

equal-cost multipathing, 132–133

unequal-cost load balancing, 133–134

MFIB (multicast forwarding information base), 344

MIMO (multiple-input, multiple-output) system, 505

misconfigurations, MST

trunk link pruning, 88

VLAN assignment to the IST, 87

MLSs (multilayer switches), 4

Mobility Express topology, 520

mobility groups, 551–552

modulation, 502

MP-BGP (Multi-Protocol BGP), 244, 273

MQC (Modular QoS CLI), 369

MRIB (multicast routing information base), 344

MST (Multiple Spanning Tree)

configuring, 82

IST, 81

misconfigurations

trunk link pruning, 88

VLAN assignment to the IST, 87

region boundary, 88–89

regions, 81

not a root bridge for any VLAN, 89

as root bridge, 89

tuning, 86

changing MST interface cost, 86

changing MST interface priority, 86–87

verifying configuration, 83–85

viewing interface-specific settings, 85

MSTIs (Multiple Spanning Tree instances), 80–81

multicast. See also PIM (Protocol Independent Multicast)

addressing, 332

administratively scoped block, 333

GLOP block, 333

IGMPv2, 335

internetwork control block, 332

Layer 2, 333–335

local network control block, 332

SSM block, 333

well-known reserved addresses, 333

broadcast traffic, 330

IGMP, 329, 335–336

IGMP snooping, 337–339

IGMPv2, 335–337

IGMPv3, 337

PIM, 329, 340

control messages, 345

dense mode, 345–347

shared trees, 341–342

source trees, 340–341

sparse mode, 347–351, 354

PIM forwarder, 351–353

RPF, 351

streams, 330

unicast traffic, 329

video feed example, 330–331

N

NAC (network access control)

802.1x, 727–729

EAP, 729–732

MAB, 732–733

WebAuth, 733–735

named ACLs, 752–753

NAT (Network Address Translation), 417–418. See also PAT (Port Address Translation); static NAT

pooled, 426–429

topology, 418–420

native VLANs, 13–14

NBAR2 (Network-Based Application Recognition), 369

need for QoS, 363

neighbor route-map command, 306

neighbor states, 248–249

Active, 250

Connect, 250

Established, 251

Idle, 249

OpenConfirm, 251

OpenSent, 250–251

neighbors

BGP, 245

EIGRP, 154

OSPF, 169–170

requirements for adjacencies, 175

verification of adjacencies, 179–180

NETCONF (Network Configuration Protocol), 836–840

NetFlow, 675–677

network area command, 172

network diagnostic tools

Flexible NetFlow, 678–684

IP SLA, 692–696

NetFlow, 675–677

ping, 645–650

SNMP, 665–670

SPAN, 684–685

encapsulated remote, 690–692

local, 685–688

remote, 689–690

syslog, 670–675

traceroute, 650

network statement, 172–174, 255–256

network types

OSPF, 187–188

broadcast, 188

loopback, 189–190

point-to-point, 188–189

OSPFv3, 234–235

NFV (network functions virtualization), 792, 799–800

BSS, 801

EMs, 801

ENFV, 807–808

MANO, 808–810

VNFs and applications, 810

management and orchestration, 801

OSS, 801

VIM, 800–801

VNF, 800, 802–804

NFVI (NFV infrastructure), 800

NFVIS (Network Function Virtualization Infrastructure Software), x86 hosting platforms, 812

NGFW (Next-Generation Firewall), 721–722

NGIPS (Next-Generation Intrusion Prevention System), 719–721

NLRI (Network Layer Reachability Information), 243, 273

no switchport command, 22

non-overlapping channel spacing, 488

Northbound APIs, 819

NSF (nonstop forwarding), 29–30

NSR (nonstop routing), 29–30

NTP (Network Time Protocol), 396

associations, viewing, 398–399

configuration, 397–398

peers, 400

stratums, 396–397

preferences, 399

viewing status of, 398–399

ntp master command, 397

ntp peer command, 400

null interfaces, 140–141

number of edges formula, 170

numbered ACLs, 750–751

numbered extended ACLs, 751–752

O

object tracking, 402–404

OFDM (Orthogonal Frequency Division Multiplexing), 503

OIF (outgoing interface), 344

omnidirectional antennas, 531–534

OpenConfirm state, 251

OpenSent state, 250–251

order of processing, route maps, 300

OSI (Open Systems Interconnection) model, 3–4

data link layer, 4

OSPF (Open Shortest Path First), 164. See also OSPFv3

ABRs, 197–199

adjacencies, debugging, 656–662

Area 0, 167–168, 197

area filtering, 218–220

area ID, 199

areas, 196–197

BDR, 170–172

configuration, 176–177

interface-specific, 174

network statement, 172–174

dead interval timer, 183

default route advertisement, 181–182

discontiguous networks, 209–210

distribute lists, 220–222

DR, 170–172, 183–184, 186–187

elections, 184

placement, 185–186

DROTHER, 179

equal cost multipathing, 212

inter-area routes, 199

interfaces, 178–179

confirmation, 177

output in brief format, 178

output in detailed format, 177–178

inter-router communication, 168

intra-area routes, 199

local filtering, 220–222

LSAs, 166, 201–202

age and flooding, 202

sequences, 202

Type 1, 202–204

Type 2, 205–206

Type 3, 207–209

LSDB, 166

multi-area topology, 198–199

multicast addresses, 168

neighbors, 169–170

requirements for adjacencies, 175

verification of adjacencies, 179–180

network types, 187–188

broadcast, 188

loopback, 189–190

point-to-point, 188–189

number of edges formula, 170

optimizations

failure detection, 183

link costs, 182–183

packets, 168

hello, 169

passive interfaces, 174–175

path selection, 210

interarea routes, 211–212

intra-area routes, 210–211

pseudonodes, 171

recursive routing, 444–445

RID, 169

route filtering, 217

with summarization, 217–218

route summarization, 212–214

interarea, 214–217

route types, 199–201

routes, verification, 180–181

SPTs, 166

statistically setting the router ID, 174

timers, 183

OSPFv3, 224

communication, 227–228

configuration, 228–231

IPv6 configuration, 229–231

LSAs, 226–227

network types, 234–235

versus OSPFv2, 225–226

passive interfaces, 233

route summarization, 233–234

support for IPv4, 235–237

verification, 231–232

ospfv3 ipv4 command, 235

ospfv3 network command, 235

OSS (operations support system), 801

OUI (organizationally unique identifier), 5

outside static NAT, 423–426

overlay networks, 436. See also fabric technologies

recursive routing, 444–445

SD-Access, 619

OVS-DPDK, 805

P

packet loss, 366

packet routing, 19–20

packets

EtherChannel, verifying, 111

IGMP, 335–336

OSPF, 168

hello, 169

OSPFv3, 227–228

PACLs (port ACLs), 753–754

processing order, 755–756

PAgP (Port Aggregation Protocol), 111–112

port modes, 104

viewing packet counters, 112

pairing, lightweight APs and WLCs, 521

PAs (path attributes), 244

passive command, 174

passive interfaces

OSPF, 174–175

OSPFv3, 233

passwords

authentication, 758

in Cisco IOS, 757

encryption, 757–758

PAT (Port Address Translation), 418, 429–432

configuring, 429–430

generating network traffic, 430–431

patch antennas, 534–537

AS Path ACL filtering, 305–306

path attributes, 243

path selection

AD, 131–132

BGP using longest match, 314–315

metrics, 132

equal cost multipathing, 132–133

unequal-cost load balancing, 133–134

OSPF, 210

interarea routes, 211–212

intra-area routes, 210–211

prefix length, 130–131

path vector routing protocols, 128–129

PCI passthrough, 805–806

PCP (Priority code point) field, 7, 370–371

peers, NTP, 400

PETR (proxy ETR), 471–472

PFS (perfect forward secrecy), 450–451

phase, 489

PHBs (per-hop behaviors), 372

Assured Forwarding, 373–374

Class Selector, 372

Default Forwarding, 373

Expedited Forwarding, 374–375

PIM (Protocol Independent Multicast), 329, 340

BSR, 356–357

control messages, 345

dense mode, 345–347

shared trees, 341–342

source path trees, 348

source trees, 340–341

sparse mode, 347

designated routers, 350–351

RPs, 354

shared tree join, 348–349

shared trees, 348

source registration, 349

SPT switchover, 349–350

terminology, 343–344

PIM forwarder, 351–353

ping command, 645–650

PITR (proxy ITR), 472–473

playbooks, 877–879

point-to-point networks, 188–189

polar plots, 528

polarization, 530–531

policers, 377–378

single-rate three-color, 382–383

two-rate three-color, 384–386

pooled NAT, 418, 426–429

clearing NAT translations, 429

configuring, 426–427

viewing NAT table, 427–428

port channel, 102. See also EtherChannel

port modes

LACP, 104–105

PAgP, 104

port states

802.1D STP, 37

RSTP, 52

port-channel min-links command, 113–114

port-channel status, verifying, 106

portfast, 66–67

Postman

Cisco DNA Center APIs, 826–831

dashboard, 821–824

HTTP status codes, 826

JSON, 825–826

XML, 824–825

power levels

amplitude, 490–491

comparing between transmitters, 491

comparing using dB, 493

dB laws, 492–493

dBm (dB-milliwatt), 494–495

measuring along the signal path, 495–497

orders of magnitude, 491–492

at the receiver, 499–501

prefix advertisement, 255–257

prefix length, 130–131

prefix lists, 293, 295–296

route filtering, 304–305

prefix matching, 293–295

Pre-Shared Key, 563–565

pre-shared key, 448

private ASNs, 242

private BGP communities, 309, 312–313

privilege levels, 761–764

process switching, 25–26

CEF, 26

centralized forwarding, 27

propagation delay, 364–365

Protocol Discovery, 369

pseudonodes, 171

Puppet, 866–868

Puppet Bolt, 886–887

PVST (Per-VLAN Spanning Tree), 80

simulation check, 89

Python scripts, 846–853

Q

QoS (Quality of Service)

causes of quality issues

lack of bandwidth, 363–364

latency, 364–366

packet loss, 366

classification, 368

Layer 7, 369

congestion management, 386–387

queuing algorithms, 387–388

DiffServ model, 367–368

DSCP PHBs with decimal and binary equivalents, 375

IntServ model, 366–367

markdown, 378–379

marking, 369

Layer 2, 370

Layer 3, 371

need for, 363

PHBs, 372

Assured Forwarding, 373–374

Class Selector, 372

Default Forwarding, 373

Expedited Forwarding, 374–375

policers, 377–378

single-rate three-color, 382–383

two-rate three-color, 384–386

RSVP, 366–367

scavenger class, 375

shapers, 377–378

token bucket algorithms, 379–381

trust boundaries, 376–377

wireless, 377

quality issues, causes of

delay variation, 365–366

lack of bandwidth, 363–364

packet loss, 366

propagation delay, 364–365

serialization delay, 365

query modifiers, regular expressions, 296

R

radiation patterns, 526–529

radio frequency, 485

RADIUS, 772–773

RD (reported distance), 152

receivers, power levels, 499–501

recursive routing, 444–445

recursive static routes, 136–137

RED (random early detection), 390

refractive index, 364

region boundary, 88–89

regions, 89

MST, 81

as root bridge, 89

regular expressions, 296–297

remote SPAN, 689–690

resiliency, network, 401

REST (Representational State Transfer) APIs, 820

RESTCONF, 840–841

RF fingerprinting, 554

RF signals

absolute power values, 491–492

amplitude, 490–491

carrier signals, 501–503

demodulation, 502

DRS, 508–510

free space path loss, 497–499

maximal-ratio combining, 508

maximizing the AP-client throughput, 508–509

measuring power levels along the signal path, 495–497

measuring wavelength, 489–490

modulation, 502

phase, 489

power levels, 491–493

power levels at the receiver, 499–501

spatial multiplexing, 504–507

transmit beamforming, 507–508

RIB (Routing Information Base), 26

RID (router ID), 169

statistically setting, 174

roaming, 542

between autonomous APs, 542–544

intracontroller, 545–547

Layer 2, 547–549

Layer 3, 549–551

root bridge, 37

election, 40–42

MST region as, 89

placement, 58–61

root bridge identifier, 38

root guard, 66

root path cost, 38

root ports

locating, 42–43

modifying location, 61–63

route aggregation

BGP, 264–269

with AS_SET, 270–273

atomic aggregate, 269–270

IPv6, 278–280

route filtering, 217, 301–303

distribute lists, 303–304

AS Path ACL filtering, 305–306

prefix lists, 304–305

with summarization, 217–218

route maps, 297–298, 306–308

order of processing, 300

route summarization

BGP, 263–264

EIGRP, 161–162

IPv6, 278–280

OSPF, 212–214

interarea, 214–217

OSPFv3, 233–234

routed subinterfaces, IP address assignment, 21–22

routed switch ports

configuring, 23

IP address assignment, 22

route-map command, 297

router ospfv3 command, 228

routers

Cisco SD-WAN, 634–635

OSPF, verification of, 180–181

VRF, 143–146

routing protocols, 124. See also BGP (Border Gateway Protocol); EIGRP (Enhanced Interior Gateway Routing Protocol); OSPF (Open Shortest Path First); OSPFv3

AS, 125

distance vector, 126

EGPs, 125

enhanced distance vector, 127

hybrid, 127

IGPs, 125

link-state, 127–128

path selection, 130

AD, 131–132

metrics, 132–134

prefix length, 130–131

path vector, 128–129

static routes, 134

floating, 138–140

fully specified, 137–138

IPv6, 142–143

null interfaces, 140–141

recursive, 136–137

routing tables, 130

order of processing, 132

OSPF, 199–201

RP (root port), 37

RPF (Reverse Path Forwarding), 343, 351

RPs (rendezvous points), 354

Auto-RP, 355

candidate RPs, 355

mapping agents, 355–356

static RP, 354–355

RPs (route processors), 29

RSTP (Rapid Spanning Tree Protocol), 52

building the topology, 53–54

port roles, 52–53

port states, 52

port types, 53

RTLS (real-time location services), 553

S

SaltStack, 873–875

SaltStack SSH, 887–888

SAs (security associations), 449

scavenger class, 375

SD-Access, 610, 612, 615–616

Cisco DNA Assurance workflow, 631–632

Cisco DNA design workflow, 628–629

Cisco DNA policy workflow, 629–630

Cisco DNA provision workflow, 630–631

components, 616

control plane, 619–620

controller layer, 626–628

fabric border nodes, 624

fabric control plane node, 624

fabric data plane, 620–621

fabric edge nodes, 623–624

fabric policy plane, 621–622

fabric roles and components, 622–623

fabric WLC, 624–625

management layer, 628

network layer, 617–618

overlay network, 619

physical layer, 617

technologies used in, 626

underlay network, 618–619

SDM (Switching Database Manager) templates, 30–31

sdm prefer command, 30

SD-WAN, 612, 632–633

architecture, 633–634

vAnalytics, 636

vBond Orchestrator, 635

vManage NMS, 634

vSmart controllers, 634

security. See also IPsec

AMP, 713–714

authentication

with EAP, 563–565

Open Authentication, 561–563

with Pre-Shared Key, 563–565

with WebAuth, 571–574

branch, 708

campus, 708

Cisco AnyConnect, 714–715

Cisco IBNS, 735

Cisco ISE, 725–727

Cisco SAFE, 710–711

Cisco Stealthwatch, 722–723

Cloud, 724–725

Enterprise, 723–724

Cisco Umbrella, 715

cloud, 709

data center, 708

endpoints, 711

ESA, 718–719

FMC, 722

IPsec, 445

authentication header, 446

Cisco FlexVPN, 456

DMVPN, 455

ESP, 446–448

GET VPN, 455

IKE, 449

IKEv1, 449–452

IKEv2, 452–454

site-to-site VPNs, 455

transform sets, 448–449

VPNs, 454–455

MACsec, 741–743

NAC

802.1x, 727–729

EAP, 729–732

MAB, 732–733

WebAuth, 733–735

NGFW, 721–722

NGIPS, 719–721

privilege levels, 761–764

Talos, 711–712

TrustSec, 735–743

WSA, 716–718

security services, IPsec, 446

selecting, WLCs, 524

self zone, 777

serialization delay, 365

server virtualization, 792, 794

containers, 796–797

virtual switching, 797–799

VMs, 794–796

sessions, BGP, 245

verification, 253–255

set actions, 300–301

SGT (Security Group Tag) tags, 735–743

SHA (Secure Hash Algorithm), 448

shapers, 377–378

shared trees, 341–342, 348

show bgp command, 258

show bgp ipv4 unicast summary command, 260

show bgp ipv6 unicast summary command, 276

show bgp summary command, 253

show etherchannel load-balance command, 118

show etherchannel port command, 108–110

show etherchannel summary command, 106–107

show glbp brief command, 414

show glbp command, 416–417

show interface status command, 17–18

show interface tunnel command, 443

show interfaces switchport command, 16–17

show interfaces trunk command, 12–13, 100–101

show ip nat translations command, 422, 426

show ip ospf database summary command, 207

show ip ospf interface brief command, 184

show ip ospf neighbor command, 231

show ip route ospf command, 180

show ipv6 interface command, 24

show ipv6 route ospf command, 232

show lacp counters command, 112

show lacp neighbor command, 111

show mac address-table dynamic command, 14–16

show ntp associations command, 398–399

show ntp status command, 397

show ospfv3 interface brief command, 232

show ospfv3 interface command, 231–232

show pagp counters command, 112

show pagp neighbor command, 111

show sdm prefer command, 31

show spanning-tree command, 83–84

show spanning-tree interface command, 46–47

show spanning-tree mst command, 84–85

show spanning-tree mst configuration command, 83

show spanning-tree mst cost command, 86

show spanning-tree root command, 40–41, 43

show spanning-tree vlan command, 59–60, 62–64

show standby command, 407

show track command, 402–403

show udld neighbors command, 73–74

show vlan command, 8–9

keywords, 9–11

show vrrp command, 410, 412

show vtp status command, 97–98

simplified campus design, 607–609

single-rate three-color markers, 382–383

SISO (single-in, single-out) system, 505

site-to-site VPNs, 455

configuring, 456

GRE, 457–462

verifying, 461–462

VTI, 462–464

SLA (service-level agreement), 364

slow path. See process switching

SNMP (Simple Network Management Protocol), 665–670

software CEF, 28–29

software switching. See process switching

source path trees, 348

source trees, 340–341

Southbound APIs, 820

SPAN (Switch Port Analyzer), 684–685

encapsulated remote, 690–692

local, 685–688

remote, 689–690

spanning-tree mode mst command, 82

spanning-tree portfast command, 66

spatial multiplexing, 504–507

SPF (shortest path first), 128, 166

split-MAC architecture, 516

spread spectrum, 502–503

SPs (service providers), BGP multihoming, 287–288

SPTs (SPF trees), 166

SSH (Secure Shell), vty access, 768–769

SSIDs (service set identifiers), 514–515

SSM (source specific multicast) block, 333

SSO (stateful switchover), 29–30

standard ACLs (access control lists), 291–292

standby track decrement command, 408

stateful switchover, 29–30

static EtherChannel, 105

static NAT, 418

inside, 420–423

outside, 423–426

static routes, 134

directly attached, 135–136

floating, 138–140

fully specified, 137–138

IPv6, 142–143

null interfaces, 140–141

recursive, 136–137

static RP, 354–355

statistically setting the router ID, 174

STP (Spanning Tree Protocol), 81. See also MST (Multiple Spanning Tree); RSTP (Rapid Spanning Tree Protocol)

802.1D, 36

port states, 37

port types, 37

BPDU filter, 70–71

BPDU guard, 67–70

BPDUs, 38

Error Recovery, 69

forward delay, 38

hello time, 38

local bridge identifier, 38

locating blocked designated switch ports, 43–46

loop guard, 71–72

max age, 38

path cost, 39

portfast, 66–67

protection mechanisms, 65–66

root bridge, 37

root bridge election, 40–42

root bridge identifier, 38

root guard, 66

root path cost, 38

root ports, locating, 42–43

system priority, 38

topology changes, 47–48

convergence with direct link failures, 48–51

indirect failures, 51–52

topology tuning

modifying port priority, 64–65

modifying STP root port and blocked switch port locations, 61–63

root bridge placement, 58–61

UDLD, 72–74

unidirectional links, 71

verifying VLANs on trunk links, 46–47

stratums, 396–397

preferences, 399

streams, 330

strings, 848

subset advertisements, 95

successor routes, 152

successors, 152

summarization

BGP, 263–264

EIGRP, 161–162

IPv6, 278–280

OSPF, 212–214

interarea, 214–217

OSPFv3, 233–234

summary advertisements, 95

SVIs (switched virtual interfaces)

creating, 22

IP address assignment, 22

switch port status, viewing, 16–17

switches, 5

access ports, 11

collision domains, 5–6

TCAM, 26–27

unknown unicast flooding, 6

switchport access command, 11

switchport mode access command, 11

switchport mode trunk command, 12

switchport negotiate command, 101

switchport trunk allowed command, 14

switchport trunk native vlan command, 13

syslog, 670–675

system priority, 38, 115–116

T

tables, BGP, 257–260

TACACS+, 771–772

Talos, 711–712

Tc (Committed Time Interval), 379

TCAM (ternary content addressable memory), 26–27

TCI (Tag Control Information) field

DEI field, 371

PCP field, 370–371

VLAN ID field, 371

Tcl scripts, 863–865

TCNs (topology change notifications), 47–48

TCP/IP (Transmission Control Protocol/Internet Protocol)., 20

terminal lines, 756–757

testing a wireless client, 585–588

Thinnet, 5

three-tier design, 604–605

time synchronization, 396. See also NTP (Network Time Protocol)

timers

EIGRP, 159

OSPF, 183

token bucket algorithms, 379–381

topology changes, 47–48

convergence with direct link failures, 48–51

indirect failures, 51–52

topology table, 153–154

topology tuning

modifying STP port priority, 64–65

modifying STP root port and blocked switch port locations, 61–63

root bridge placement, 58–61

TPID (Tag protocol identifier) field, 7

traceroute command, 650

track ip route reachability command, 402

transform sets, 448–449

transmit beamforming, 507–508

transmitters, measuring power levels along the signal path, 495–497

transport input, controlling access to vty lines, 765–768

troubleshooting

adjacencies, 656–662

connectivity problems at the AP, 588–592

EtherChannel, 116–117

Layer 2 forwarding, 16

unidirectional links, 71

wireless networking, client connectivity, 579–581

trunk link pruning, 88

trunk port negotiation, disabling, 101

trunk ports, 12

configuring, 12

trust boundaries, 376–377

TrustSec, 735–743

TTL (time-to-live) field, 28–29

tuning

MST, 86

changing MST interface cost, 86

changing MST interface priority, 86–87

OSPF

failure detection, 183

link costs, 182–183

tunnel destination command, 441

tunnel protection command, 459

tunneling, 436. See also VXLAN (Virtual Extensible Local Area Network)

GRE, 439

configuring, 440–442

encapsulation, 439

encapsulation overhead, 442

site-to-site over IPsec, 457–462

verifying, 443–444

two-rate three-color markers, 384–386

two-tier design, 602–604

Type 1 LSAs, 202–204

Type 2 LSAs, 205–206

Type 3 LSAs, 207–209

U

UDLD (Unidirectional Link Detection), 72–74

Umbrella, 715

unequal-cost load balancing, 133–134, 158

unidirectional links, 71

unified wireless topology, 516–517

unique global unicast addressing, 274

unknown unicast flooding, 6

upstream, 344

username and password authentication, 758

V

VACLs (VLAN ACLs), 754–755

processing order, 755–756

vAnalytics, 636

variance multiplier, 157

vBond Orchestrator, 635

verifying

AAA configuration, 776

BGP sessions, 253–255

CoPP, 787–789

DTP, 100–101

EAP configuration, 571

EtherChannel packets, 111

GRE tunnels, 443–444

HSRP status, 407–408

IP address assignment, 23–24

IPsec site-to-site VPNs, 461–462

IPv4 route exchange with OSPFv3, 236–237

MST configuration, 83–85

OSPF adjacencies, 179–180

OSPF routes, 180–181

OSPF timers, 183

OSPFv3 configuration, 231–232

port-channel status, 106

VLANs on trunk links, 46–47

VTP, 97–99

versions, of HSRP, 404

VID (VLAN identifier) field, 7

viewing

BGP tables, 276–277

EtherChannel neighbors, 108–110

GLBP status, 414–415

hierarchical VRRP status, 412–413

interface status, 17–18

interface-specific MST settings, 85

LACP neighbor information, 111

MAC address table, 14–16

NTP associations, 398–399

NTP status, 398–399

PAgP packet counters, 112

port-channel interface status, 108

switch port status, 16–17

VLAN assignments to port mapping, 8–9

VRRP status, 410–411

VIM (NFVI Virtualized Infrastructure Manager), 800–801

virtual switching, 797–799

virtualization, 12. See also NFV (network functions virtualization); server virtualization

vlan command, 8

VLAN ID field, 371

VLANs (virtual LANs), 7–8

access ports, 11

allowed, 14

assignment to the IST, 87

creating, 8

on VTP domain server, 97–98

native, 13–14

packet structure, 7–8

regions, 89

trunk ports, 12

configuring, 12

verifying on trunk links, 46–47

viewing assignments to port mapping, 8–9

VLSM (variable-length subnet masking), 164

vManage NMS, 634

VMs (virtual machines), 794–796

VNF (virtual network function), 800

OVS-DPDK, 805

PCI passthrough, 805–806

performance, 802–804

SR-IOV, 806–807

VNIs (VXLAN network identifiers), 474

VPNs (virtual private networks), 436. See also IPsec

IPsec, 445, 454–455

authentication header, 446

Cisco FlexVPN, 456

DMVPN, 455

ESP, 446–448

GET VPN, 455

IKE, 449

IKEv1, 449–452

IKEv2, 452–454

security services, 446

site-to-site, 455

transform sets, 448–449

vQoE (Viptela Quality of Experience) score, 639

VRF (virtual routing and forwarding), 143–146

VRRP (Virtual Router Redundancy Protocol), 409

hierarchical configuration, 411–412

viewing status of, 412–413

legacy configuration, 410–411

viewing status of, 410–411

vSmart controllers, 634

vSwitches, 797–799

VTEPs (virtual tunnel endpoints), 474

VTI, enabling over IPsec, 462–464

VTP (VLAN Trunking Protocol), 94–95

advertisements, 95

configuring, 95–96

verifying, 97–99

VLANs, creating on VTP domain server, 97–98

vtp domain command, 96

vty lines, 756

controlling access to, 764–768

enabling SSH access, 768–769

VXLAN (Virtual Extensible Local Area Network), 436, 473

VNIs, 474

VTEPs, 474

W

WANs, 612

wavelength, measuring, 489–490

WebAuth, 571–574, 733–735

weight attribute, 316

well-known BGP communities, 309

well-known reserved multicast addresses, 333

wide metrics, 156–157

wireless communication, troubleshooting connectivity problems at the AP, 588–592

wireless networking. See also antennas; RF signals; wireless theory

APs

autonomous, 514–516

Cisco AP modes, 525–526

lightweight, 516–520

states, 521–523

authentication

with EAP, 565–571

Open Authentication, 561–563

with Pre-Shared Key, 563–565

with WebAuth, 571–574

CAPWAP, 521

conditions for successful wireless association, 579

DRS, 508–510

embedded wireless networks, 518

leveraging antennas for wireless coverage, 526

locating devices in a wireless network, 552–555

maintaining AP-client compatibility, 503–505

maximal-ratio combining, 508

maximizing the AP-client throughput, 508–509

Mobility Express topology, 520

pairing lightweight APs and WLCs, 521

spatial multiplexing, 504–507

testing a wireless client, 585–588

transmit beamforming, 507–508

WLCs

availability, 524–525

discovering, 523

selecting, 524

wireless QoS, 377

wireless theory, 482–483. See also antenna; power levels

decibel (dB), 492–494

free space path loss, 497–499

frequency, 484–488

measuring wavelength, 489–490

phase 489

RF power, 490–491

WLCs

availability, 524–525

checking client association and signal status, 582–584

checking client connection status from the GUI, 582

checking client mobility status, 584–585

checking client wireless policy, 585

client connectivity, troubleshooting, 579–581

discovering, 523

mobility groups, 551–552

SD-Access, 624–625

selecting, 524

WRED (weighted RED), 390

WSA (Cisco Web Security Appliance), 716–718

web reputation filters, 716

X

XML (Extensible Markup Language), 824–825

Y

Yagi antenna, 535–536

YAML (Yet Another Markup Language), 879–880

YANG (Yet Another Next Generation) models, 834–836

Z

ZBFW (Zone-Based Firewall), 777

configuring, 778–784

default zone, 777–778

self zone, 777