system login: sysadmin@5umrn3t!
July 19, 2009
Unix/IP Preparation Course
July 20, 2009
Introduction to Campus Network Design
REN - Research and Education Network
Reliability is the key - reliable power, reliable air conditioning
Firewalls and Traffic Shaping Devices
Intrusion Detection, Intrusion Prevention
Network Address Translation
Border routers separate from core routers
Border Router MUST get Provider Independent IP address space.
Structured Network Cabling
2+ cables to every outlet; 4 recommended; 6 if the dist is less than 90 meters
Strongly recommend category 5e cabling
Labeling is a key to reduce work later. Label them on the jacks on the router/switches.
Multi Mode : 2km@100Mbps. 62.5/50 micron core
Single Mode : 70km@virtually unlimited speed.
* optimized for 1310 & 1550 nm operation
* optimized for WDM operation
Physics of Fiber: see this link
A list of costs of different types of fiber... SO EXPENSIVE!!! starting from $250 USD...
Single mode fiber is more popular in US currently since factories do not manufacture many multi mode fibers any more.
Dispersion is the major limit on long-distance cabling using optical fiber.
Amplification device is necessary for networks located farther between than the maximum length limit of a certain type of optical fiber.
* from core network to individual buildings
* inside of buildings from main phone closet to other closets
Outdoor cable between buildings: armored & loose cube
Indoor cable inside buildings: tight buffer
Standardize on Connectors:
* Multi mode: ST or SC (epoxy or hot melt)
* Single mode: SC or SL (fusion splice factory pigtails, however hand polish is OK if done properly)
* more details on fusion splicing
If the cable needs to bend in its path, make sure the diameter of the path is at least 14 times larger than the diameter of the cable.
For cable installed in underground conduit:
* no more than 200m between pull points
* reduce distance by 50m for every 90 degrees of bend
Leave slack loops.
WDM - Wave Division Multiplexing
using different colors of light 不同波长的光信号共享同一根光缆传输信号
* fewer waves, low cost
* 1310nm freq spectrum
* Dense: more waves
UADM?? what is this..
July 21, 2009
Layer 2 Network Design
University of Oregon
In-Building and Layer 2
* Switching inside a building: small network
* Routing between buildings: large network
Layer 2 Concepts: Layer 2 protocols control access to a shared medium
* Source and Destination id - MAC address
* Detect and avoid frame collisions
* listen and wait for channel to be available
* if collision occurs, wait a random period before retrying: CASMA-CD (should this be CSMA-CD?)
Evolution of Ethernet Topologies
Hub: receives information and sends it to all ports (集线器)
Switch: learns the location of each node by looking at the source address of each incoming frame, and builds a forwarding table（交换机）
A switch broadcasts come frames:
* when the destination is not found in the table
* when the frame is destined to the broadcast address (FF:FF:FF:FF:FF:FF)
* when the frame is destined to a multi-cast Ethernet address
* So, switches do not reduce the broadcast domain!
Switch vs. Router
* Ethernet frames vs IP packets
* IP packets travel inside Ethernet frames
* IP networks can be logically segmented into subnets
* Switches do not usually know about IP, they only deal with Ethernet frames
Routers do not forward Ethernet broadcasts. So:
* Switches reduce the collision domain
* Routers reduce the broadcast domain
* Try to eliminate collision domains – Get rid of hubs!
* Try to keep your broadcast domain limited to no more than 250 simultaneously connected hosts
* Segment your network using routers
Layer 2 Network Design Guidelines
* Always connect hierarchically
* If there are multiple switches in a building, use an aggregation switch
* Locate the aggregation switch close to the building entry point (e.g. fiber panel)
* Locate edge switches close to users (e.g. one per floor)
* Minimize path between elements (star better than chain)
* Build incrementally
* Keep growing within the same hierarchy
* Add redundancy, or the possibility of failure will rise
* Add a redundant aggregation switch
* Do not daisy-chain, connect buildings hierarchically
* Allow us to split switches into separate (virtual) switches
* Only members of a VLAN can see that VLAN's traffic
* Reason of virtualization: reduce the cost of devices.
* Inter-switch links are configured as trunks, carrying frames from all or a subset of a switch’s VLANs
* The IEEE standard that defines how Ethernet frames should be tagged when moving across switch trunks
* This means that switches from different vendors are able to exchange VLAN traffic
* 16-bit tag inserted to normal Ethernet frame
* VLAN + 802.1Q Trunk -> VLAN Trunking
Tagged vs. Untagged
* edge ports are not tagged, they are just “members” of a VLAN
* only need to tag frames in trunks
* a trunk can transport both tagged and untagged VLANs
* As long as the two switches agree on how to handle those
VLANS increase complexity
* You can no longer “just replace” a switch
* You have to make sure that all the switch- to-switch trunks are carrying all the necessary VLANs
Good reasons to use VLANs
* You want to segment your network into multiple subnets, but can’t buy enough switches
* Hide sensitive infrastructure like IP phones, building controls, etc.
* Separate control traffic from user traffic
* Restrict who can access your switch management address
Bad reasons to use VLANs
* Because you can, and you feel cool...
* Because they will completely secure your hosts (or so you think)
* Because they allow you to extend the same IP network over multiple separate buildings
Do not build “VLAN spaghetti”
// Can anybody tell me who is Kevin Anderson? firstname.lastname@example.org?? It's me, Yang.
_You can use multiple links in parallel as a single, logical link
increased capacity and redundancy
Distributing Traffic in Bundled Links
using a hashing algorithm, based on source/destination IP, MAC, PORT
use the load-balancing method
Forwarding tables become unstable
Switches will broadcast each other’s broadcasts
Good Switching Loops: Redundant paths
* to have bridges dynamically discover a subset of the topology that is loop-free (a tree) and yet has just enough connectivity so that where physically possible, there is a path between every switch
* Several flavors:
* STP Design Guidelines
Enable spanning tree even if you don't have redundant paths plan and set bridge priorities do not accept BPDUs on end-user ports
* 802.1d Convergence Speed
Blocking -> Forwarding : ~30s Topologies changes: ~30s
* Choose the right root bridge!
* While STP can take 30 to 50 seconds to respond to a topology change, RSTP is typically able to respond to changes within a second.
* MSTP includes all of its spanning tree information in a single BPDU format. Not only does this reduce the number of BPDUs required on a LAN to communicate spanning tree information for each VLAN, but it also ensures backward compatibility with RSTP (and in effect, classic STP too).
July 22, 2009
Core Network Design
* Routing Architectures
* Where to route?
* At the point where we want to limit our layer-2 broadcast domain
* At your IP subnet boundary
* Thinking of layers helps reduce the convergence time
* topology and logical design are NOT the same
* These layers should not be confused with your layer 2 architecture
* Access layer
* Minimum routing information
* feeds traffic into the network
* provide network access control
* provide other edge services
* tagging for QoS
* tunnel termination
* traffic metering and accounting
* policy-based routing
* Distribution layer
* Isolates topology changes
* Controls the routing table size
* Aggregates traffic
* Route summarization
* Minimize the number of connections to the core
* Core layer
where you spend most of the money for performance
* Forwarding packets fast
* Clear of network policies
* Every device has full reachability to every destination
* Facilitates core redundancy
* Reduces suboptimal routing
* Prevents routing loops
* Depending in how large your campus is
* 1 core + distribution layer
* 1 core + no distribution layer + access layer
* Spend some time thinking about how you will assign address space
* the routing table is to be updated when any change is made to the network
* only provide full topology where it is needed; summarize at the hierarchy edges
* Strategies for addressing
* First come, first serve
* High Availability and Fast Convergence
* hardware resiliency and backup paths
* different tech in different layer
* evaluate your NEEDS: minimum -> medium -> high
* Redundancy, redundancy and redundancy!
* dual everything everywhere ...
* Campus Routing Protocols
* [Open Shortest Path First (OSPF)
* defined in RFC2328
* link-state routing
* using the optimal path (by the sum of costs of interfaces)
* fast convergence
* Routing Protocols and security considerations
July 23, 2009
ˈrau̇-tər Function:_noun_ Date:1818
: one that routs: as a: a routing plane b: a machine with a revolving vertical spindle and cutter for milling out the surface of wood or metal
July 24, 2009
Porn websites are illegal in your country, then why don't you block them at the core incoming place but let the college block by themselves?
I know China has blocked almost everything from the outside.
此时，边上的Cleven问我，is that real?