July 19, 2009

# Unix/IP Preparation Course

[email protected]

_

http://nsrc.org/workshops/2009/summer/unix-ip.html

July 20, 2009

# Introduction to Campus Network Design

REN - Research and Education Network

NAT or not : SIP is incompatible with NAT

Star networks instead of daisy networks

## Core Network:

Reliability is the key - reliable power, reliable air conditioning

Firewalls and Traffic Shaping Devices

Intrusion Detection, Intrusion Prevention

Border routers separate from core routers

At the core of your network should be routers - you must route, not switch. Switch at the edge.

Border Router MUST get Provider Independent IP address space.

# Structured Network Cabling

## Unshielded Twisted Pair Cable

2+ cables to every outlet; 4 recommended; 6 if the dist is less than 90 meters

Strongly recommend category 5e cabling

Labeling is a key to reduce work later. Label them on the jacks on the router/switches.

## Fiber Optic Cabling

Multi Mode : [email protected] 62.5/50 micron core

versus

Single Mode : [email protected] unlimited speed.

• optimized for 1310 & 1550 nm operation

• optimized for WDM operation

Physics of Fiber: see this link

A list of costs of different types of fiber... SO EXPENSIVE!!! starting from \$250 USD...

Single mode fiber is more popular in US currently since factories do not manufacture many multi mode fibers any more.

Dispersion is the major limit on long-distance cabling using optical fiber.

Amplification device is necessary for networks located farther between than the maximum length limit of a certain type of optical fiber.

Star configuration:

• from core network to individual buildings

• inside of buildings from main phone closet to other closets

Outdoor cable between buildings: armored & loose cube

Indoor cable inside buildings: tight buffer

Standardize on Connectors:

• Multi mode: ST or SC (epoxy or hot melt)

• Single mode: SC or SL (fusion splice factory pigtails, however hand polish is OK if done properly)

• more details on fusion splicing

If the cable needs to bend in its path, make sure the diameter of the path is at least 14 times larger than the diameter of the cable.

For cable installed in underground conduit:

• no more than 200m between pull points

• reduce distance by 50m for every 90 degrees of bend

Leave slack loops.

WDM - Wave Division Multiplexing

using different colors of light 不同波长的光信号共享同一根光缆传输信号

• Coarse

• fewer waves, low cost

• 1310nm freq spectrum

• Dense: more waves

July 21, 2009

# Layer 2 Network Design

Carlos Vicente

University of Oregon

[email protected]

Review...

Redundant

In-Building and Layer 2

• Switching inside a building: small network

• Routing between buildings: large network

Layer 2 Concepts: Layer 2 protocols control access to a shared medium

Ethernet Functions

• Source and Destination id - MAC address

• Detect and avoid frame collisions

• listen and wait for channel to be available

• if collision occurs, wait a random period before retrying: CASMA-CD (should this be CSMA-CD?)

Ethernet Frame

Evolution of Ethernet Topologies

• Bus

• Star

Hub: receives information and sends it to all ports (集线器)

Switch: learns the location of each node by looking at the source address of each incoming frame, and builds a forwarding table（交换机）

• when the frame is destined to a multi-cast Ethernet address

• So, switches do not reduce the broadcast domain!

Switch vs. Router

• Ethernet frames vs IP packets

• IP packets travel inside Ethernet frames

• IP networks can be logically segmented into subnets

• Switches do not usually know about IP, they only deal with Ethernet frames

Routers do not forward Ethernet broadcasts. So:

• Switches reduce the collision domain

• Routers reduce the broadcast domain

Traffic Domains

• Try to eliminate collision domains – Get rid of hubs!

• Try to keep your broadcast domain limited to no more than 250 simultaneously connected hosts

• Segment your network using routers

Layer 2 Network Design Guidelines

• Always connect hierarchically

• If there are multiple switches in a building, use an aggregation switch

• Locate the aggregation switch close to the building entry point (e.g. fiber panel)

• Locate edge switches close to users (e.g. one per floor)

• Minimize path between elements (star better than chain)

• Build incrementally

• Keep growing within the same hierarchy

• Add redundancy, or the possibility of failure will rise

• Add a redundant aggregation switch

• Do not daisy-chain, connect buildings hierarchically

VLAN

• Allow us to split switches into separate (virtual) switches

• Only members of a VLAN can see that VLAN's traffic

• Reason of virtualization: reduce the cost of devices.

• Inter-switch links are configured as trunks, carrying frames from all or a subset of a switch’s VLANs

802.1Q

• The IEEE standard that defines how Ethernet frames should be tagged when moving across switch trunks

• This means that switches from different vendors are able to exchange VLAN traffic

• 16-bit tag inserted to normal Ethernet frame

• VLAN + 802.1Q Trunk -> VLAN Trunking

Tagged vs. Untagged

• edge ports are not tagged, they are just “members” of a VLAN

• only need to tag frames in trunks

• a trunk can transport both tagged and untagged VLANs

• As long as the two switches agree on how to handle those

VLANS increase complexity

• You can no longer “just replace” a switch

• You have to make sure that all the switch- to-switch trunks are carrying all the necessary VLANs

Good reasons to use VLANs

• You want to segment your network into multiple subnets, but can’t buy enough switches

• Hide sensitive infrastructure like IP phones, building controls, etc.

• Separate control traffic from user traffic

• Because you can, and you feel cool...

• Because they will completely secure your hosts (or so you think)

• Because they allow you to extend the same IP network over multiple separate buildings

Do not build “VLAN spaghetti”

// Can anybody tell me who is Kevin Anderson?   [email protected]??          It's me, Yang.

_You can use multiple links in parallel as a single, logical link

increased capacity and redundancy

LACP

using a hashing algorithm, based on source/destination IP, MAC, PORT

Switching loop

Forwarding tables become unstable

Good Switching Loops: Redundant paths

Spanning Tree Protocol

• to have bridges dynamically discover a subset of the topology that is loop-free (a tree) and yet has just enough connectivity so that where physically possible, there is a path between every switch

• Several flavors:

• 802.1d

• [这里](http://en.wikipedia.org/wiki/Spanning_tree_protocol#Protocol_operation)的图和解释很清楚

• STP Design Guidelines

Enable spanning tree even if you don't have redundant paths

plan and set bridge priorities

do not accept BPDUs on end-user ports

• 802.1d Convergence Speed

Blocking -> Forwarding : ~30s

Topologies changes: ~30s

• Choose the right root bridge!

• RapidSTP 802.1w

• While STP can take 30 to 50 seconds to respond to a topology change, RSTP is typically able to respond to changes within a second.

• MultipleSTP 802.1s

• MSTP includes all of its spanning tree information in a single BPDU format. Not only does this reduce the number of BPDUs required on a LAN to communicate spanning tree information for each VLAN, but it also ensures backward compatibility with RSTP (and in effect, classic STP too).


July 22, 2009

# Core Network Design

José Domínguez

• Routing Architectures

• Where to route?

• At the point where we want to limit our layer-2 broadcast domain

• At your IP subnet boundary

• Thinking of layers helps reduce the convergence time

• topology and logical design are _**NOT**_ the same

• These layers should not be confused with your layer 2 architecture

• Access layer

•   Minimum routing information

•   feeds traffic into the network

•   provide network access control

•   provide other edge services

•     tagging for [QoS](http://en.wikipedia.org/wiki/Quality_of_service)

•     tunnel termination

•     traffic metering and accounting

•     policy-based routing

•   Distribution layer

•   Goals

•     Isolates topology changes

•     Controls the routing table size

•     Aggregates traffic

•     Strategies

•     Route summarization

•     Minimize the number of connections to the core

•   Core layer


where you spend most of the money for performance

•   Goal

•     Forwarding packets fast

•     Strategies

•     Clear of network policies

•     Every device has full reachability to every destination

•       Facilitates core redundancy

•       Reduces suboptimal routing

•       Prevents routing loops

• Depending in how large your campus is

• 1 core + distribution layer

• 1 core + no distribution layer + access layer

• Spend some time thinking about how you will assign address space

• the _routing table_ is to be updated when any change is made to the network

• only provide full topology where it is needed; summarize at the hierarchy edges

• Strategies for addressing

• First come, first serve

• Politically

• Geographically

• Topologically

• High Availability and Fast Convergence

• hardware resiliency and backup paths

• different tech in different layer

• evaluate your _NEEDS_: minimum -> medium -> high

• Redundancy, redundancy and redundancy!

• dual everything everywhere ...

• Campus Routing Protocols

• Interior Routing Protocols (IGP)

• [Open Shortest Path First (OSPF)

](http://en.wikipedia.org/wiki/OSPF)

•   defined in [RFC2328](http://tools.ietf.org/html/rfc2328)

•   link-state routing

•   using the optimal path (by the sum of costs of interfaces)

•   fast convergence

• Exterior Routing Protocols (EGP)

• Routing Protocols and security considerations

July 23, 2009

//如果是照抄pdf，不如直接看

http://www.merriam-webster.com/dictionary/router

1rout·er Pronunciation:

  ˈrau̇-tər

Function:_noun_ Date:1818


: one that routs: as a**:** a routing plane b**:** a machine with a revolving vertical spindle and cutter for milling out the surface of wood or metal

July 24, 2009

NSRC送出手router和switch共4台

PS

Porn websites are illegal in your country, then why don't you block them at the core incoming place but let the college block by themselves?

I know China has blocked almost everything from the outside.