Protocol Filtering and Controlling LAN Floods
Attackers can cause broadcast floods to disrupt communications over the LAN. You saw an example of this in the section "MAC Address Floods and Port Security." Therefore, it is important to control flooding on the switches. There are two main ways to do this: Set up threshold limits for broadcast/multicast traffic on ports Use protocol filtering to limit broadcasts/multicasts for certain protocols Catalyst switches allow thresholds for broadcast traffic to be set up on a pe..
This lab should assist you in your final preparation for the CCIE Security lab exam. Sample solutions are provided here, but you need to research other various solutions on your own. Feel free to modify the questions to suit any design scenario and discover new IOS commands by using the Cisco Universe CD-ROM. This lab is not the only tool you should use; rather, it is provided here to demonstrate the minimum level of difficulty you will encounter when attempting the CCIE Sec..
Switches operating at Layer 2 of the OSI model are designed to be able to control the flow of data between their ports or interfaces. They do this by creating almost instant networks that contain only the two end devices communicating with each other so that information flow is increased to the optimal level. Devices not involved in this two-way communication are not involved at that moment in time. At the data link layer (Layer 2 of the OSI model), the only mechanism permit..
Using Multipoint Subinterfaces
You can connect several virtual circuits to a single subinterface as follows: Central#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Central(config)#interface Serial0.1 multipoint Central(config-subif)#description Frame Relay to branches Central(config-subif)#ip address 192.168.1.1 255.255.255.0 Central(config-subif)#frame-relay interface-dlci 101 Central(config-subif)#frame-relay interface-dlci 102 Central(config-subif)#frame-relay int..
One of the most significant shortcomings of PIM-SM is that within any given multicast network boundaries, there can be only one RP for any multicast group. This has several potential problems including slow convergence after an active RP failure and potentially extra hops required to reach a distant RP. Anycast RP solves these problems. The first RP configuration looks like this: Router-RP1#configure terminal Enter configuration commands, one per line. End with CNTL..
