Chapter 1 - Packet forwarding
What type of network device helps reduce the size of a collision domain?
Switch Explanation: A switch uses the MAC address table to limit the Layer 2 communication between only the two devices communicating with each other.
Layer 3 forwarding
The forwarding of packets based on the packets' destination IP addresses.
process switching
The process of forwarding traffic by software and processing by the general CPU. It is typically slower than hardware switching.
Trunk Ports
Trunk ports can carry multiple VLANs. Trunk ports are typically used when multiple VLANs need connectivity between a switch and another switch, router, or firewall and use only one port. Upon receipt of the packet on the remote trunk links, the headers are examined, traffic is associated to the proper VLAN, then the 802.1q headers are removed, and traffic is forward to the next port, based on MAC address for that VLAN.
Unknown unicast flooding
When a packet contains a destination MAC address that is not in the switch's MAC address table, the switch forwards the packet out of every switch port.
Reserved VLAN
1002 - 1005
Extended VLAN range
1006 - 4094
Normal VLAN range
2 - 1001
Virtual Lan (VLAN)
A logical segmentation of switch ports based on the broadcast domain.
Cisco Express Forwarding (CEF)
A method of forwarding packets in hardware through the use of the FIB and adjacency tables. CEF is much faster than process switching.
Broadcast domain
A portion of a network where a single broadcast can be advertised or received
Address Resolution Protocol (ARP)
A protocol that resolves a MAC address to specific IP address
Collision domain
A set of devices in a network that can transmit data packets that can collide with other packets sent by other devices (that is, devices that can detect traffic from other devices using CSMA/CD).
Trunk Port
A switch port that is configured for multiple VLANs and generally connects a switch to other switches or to other network devices, such as firewalls or routers.
Access port
A switch port that is configured for only one specific vlan and generally connects end user devices.
MAC address table
A table on a switch that identifies the switch port and VLAN with which a MAC address is associated for Layer 2 forwarding.
Route Processors (RPs)
An RP is responsible for learning the network topology and building the route table (RIB).
Collision Domain
As more devices are added to a cable, the less efficient the network becomes as devices wait until there is not any communication. All of the devices are in the same collision domain. Network hubs proliferate the problem because they add port density while repeating traffic, thereby increasing the size of the collision domain. Network hubs do not have any intelligence in them to direct network traffic; they simply repeat traffic out of every port.
The _________ can be directly correlated to the MAC address table.
CAM Explanation: The CAM is high-speed memory that contains the MAC address table.
Cisco Express Forwarding (CEF)
Cisco proprietary switching mechanism developed to keep up with the demands of evolving network infrastructures. It has been the default switching mechanism on most Cisco platforms that do all their packet switching using the general-purpose CPU (software-based routers) since the 1990s, and it is the default switching mechanism used by all Cisco platforms that use specialized application-specific integrated circuits (ASICs) and network processing units (NPUs) for high packet throughput (hardware-based routers). The general-purpose CPUs on software-based and hardware-based routers are similar and perform all the same functions; the difference is that on software-based routers, the general-purpose CPU is in charge of all operations, including CEF switching (software CEF), and the hardware-based routers do CEF switching using forwarding engines that are implemented in specialized ASICs, ternary content addressable memory (TCAM), and NPUs (hardware CEF). Forwarding engines provide the packet switching, forwarding, and route lookup capability to routers.
A ___________ forwarding architecture provides increased port density and forwarding scalability.
Distributed Explanation: A distributed architecture uses dedicated components for building the routing table, adjacency table, and forwarding engines. This allows for the forwarding decisions to be made closer to the packet's egress and is more scalable.
CEF is composed of which components? (Choose two.)
Forwarding Information Base Adjacency table
IPv4 addresses
IPv4 addresses are assigned with the interface configuration command ip address ip-address subnet-mask. An interface with a configured IP address and that is in an Up state injects the associated network into the router's routing table (Routing Information Base [RIB]). Connected networks or routes have an administrative distance (AD) of zero. It is not possible for any other routing protocol to preempt a connected route in the RIB.
Which of the following statements describes the MAC address table?
It is used to correlate MAC addresses to an interface. Explanation: The MAC address table is sometimes referred to as the CAM table. It is populated when frames are received on an interface by examining the source MAC address and creating a mapping of ports to MAC addresses.
Which are valid reasons for a packet to be handled in the process switching path instead of the Cisco Express Forwarding (CEF) switching path?
Packets have the destination IP address assigned to one of the router's interfaces. Packets contain IP header options such as Router Alert. Explanation: Packets are typically forwarded using the CEF switching path or hardware switching, depending on the type of router hardware in use. Certain types of packets must be sent to the software path for handling, including management-related traffic, traffic where ARP is not resolved for the next-hop address, or packets with complex header options that are not handled in the CEF switching path.
Native VLAN
A Vlan that correlates to any untagged network traffic on a trunk port.
Ternary Content Addressable Memory
A high-performance table or tables that can evaluate packet forwarding decisions based on policies or access lists.
Content Addressable Memory (CAM)
A high-performance table used to correlate MAC addresses to switch interfaces that they are attached to.
Forwarding of network traffic from a Layer 3 perspective uses what information?
Destination IP address Explanation: The destination IP address is used to locate the longest matching route and the outbound interface out which it should be forwarded.
Forwarding of network traffic from a Layer 2 perspective uses what information?
Destination MAC address Explanation: The switch uses the destination MAC address to identify the port out of which the packet should be forwarded.
What type of network device helps reduce the size of a broadcast domain?
Router Explanation: Broadcast domains do not cross Layer 3 boundaries. Splitting a Layer 2 topology into multiple subnets and joining them with a router reduces the size of a broadcast domain.
Which of the following describes the routing table?
Also known as the RIB, it is a collection of networks, next-hop addresses, and source protocol metrics. Explanation: The routing table, also referred to as the Routing Information Base (RIB), contains routing information from all source protocols, such as connected, static, and dynamic routing protocols like EIGRP and BGP. The RIB provides information on the source protocol of the route and its administrative distance/metric. The RIB does not contain the CEF adjacency or Layer 2 MAC addresses for the next hops.
Software CEF
Also known as the Software Forwarding Information Base, consists of the following components: - Forwarding Information Base: The FIB is built directly from the routing table and contains the next-hop IP address for each destination in the network. It keeps a mirror image of the forwarding information contained in the IP routing table. When a routing or topology change occurs in the network, the IP routing table is updated, and these changes are reflected in the FIB. CEF uses the FIB to make IP destination prefix-based switching decisions. - Adjacency table: The adjacency table, also known as the Adjacency Information Base (AIB), contains the directly connected next-hop IP address and their corresponding next-hop MAC address, as well as the egress interface's MAC address. The adjacency table is populated with the data from the ARP table or other Layer 2 protocol tables.
Which of the following describe ternary content addressable memory (TCAM)?
It provides a true/false/do not care result. It is used to implement hardware-based packet forwarding of certain features, like ACLs and QoS. Explanation: TCAM entries are stored in a value, mask and result (VMR) format. The value and mask allow matching on fields of interest, such as IP address and Layer 4 protocol. TCAM searches can provide three results: true, false and do not care. This flexibility and speed allow for deterministic performance for features such as ACL and QoS implemented in hardware switching platforms.
Process Switching
Process Switching, also referred as software switching or slow path, is a switching mechanism in which the general-purpose CPU on a router is in charge of packet switching. In IOS, the ip_input process runs on the general-purpose CPU for processing incoming IP packets. Process switching is the fallback for the CEF because it is dedicated to processing punted IP packets when they cannot be switched by CEF.
Virtual LANs (VLANs)
Provide logical segmentation by creating broadcast domains on the same network switch. VLANs provide higher utilization of switch ports because a port can be associated to the necessary broadcast domain, and multiple broadcast domains can reside on the same switch. Network devices in one VLAN cannot communicate with different VLAN via traditional Layer 2 or broadcast traffic.
Which answer best describes the layers of the Open Systems Interconnection (OSI) model?
Seven layers: application, presentation, session, transport, network, data link, physical Explanation: The OSI model is a seven-layer model that describes how network devices should communicate. The layers are modular, allowing interoperability between vendors. The correct names for the seven layers are application, presentation, session, transport, network, data link, and physical. The Internet Protocol suite is a four-layer model described by RFC 1122 that predates the OSI model.
Host A is connected to an Ethernet network and uses MAC address 00:00:11:11:22:22. Ethernet frames are sent to Host A. Which of the following frames will be accepted and processed by Host A?
Source MAC address 00:00:22:22:33:33, destination MAC address 00:00:11:11:22:22 Source MAC address 00:00:44:44:55:55, destination MAC address FF:FF:FF:FF:FF:FF Explanation: A host listens for Ethernet frames that have a destination MAC address equal to the MAC address of the host's NIC. A host also listens for Ethernet frames that use a broadcast destination MAC address, which is FF:FF:FF:FF:FF:FF. A frame that contains a destination MAC address that is not the broadcast address and that is not assigned to Host A will not be processed.
Stateful switchover (SSO) redundancy provides which of the following?
Synchronization of configuration and control plane state between redundant processors Explanation: SSO redundancy is possible in certain router and switch platforms when the same hardware and software is in place on the primary and secondary route processors or on the supervisor module. SSO allows checkpointing of control plane and configuration state to occur so that upon failure of the primary module, the secondary can immediately take over. Additional redundancy features such as nonstop routing (NSR) or nonstop forwarding (NSF) are required to maintain routing table information and CEF tables during an SSO switchover event to prevent packet drops.
Ternary Content Addressable Memory
TCAM allows for the matching and evaluation of a packet on more than one field. TCAM is an extension of the CAM architecture but enhanced to allow for upper-layer processing such as identifying the layer 2/3 source/destination address, protocol, QoS markings, and so on. TCAM provides more flexibility in searching than does CAM, which is binary. A TCAM search provides three results: 0 for true, 1 false, and X for do not care, which is ternary combination. The TCAM entries are stored in Value, Mark, and Result (VMR) format. The value indicates the fields that should searched, such as the IP address and protocol fields. The mask indicates the field that is of interest and that should be queried. The result indicates the action that should be taken with a match on the value and mask. Multiple actions can be selected besides allowing or dropping traffic, but tasks like redirecting a flow to a QoS polices or specifying a pointer to a different entry in the routing table are possible. Most switches contain multiple TCAM entries so that inbound/outbound security, QoS, and Layer 2 and Layer 3 forwarding decisions occur all at once. TCAM operates in hardware, providing faster processing and scalability than process switching. This allows for some features like ACLs to process at the same speed regardless of whether there are 10 entries or 500.
ARP (Address Resolution Protocol)
The ARP table provides a method of mapping Layer 3 IP addresses to Layer 2 MAC addresses by storing the IP address of a host and its corresponding MAC address. The device then uses the ARP table to add the appropriate Layer 2 headers to the data packet before sending it down to Layer 2 for processing and forwarding.
MAC address table
The MAC address table resides in content addressable memory (CAM). The CAM uses high-speed memory that is faster than typical computer RAM due its search techniques. The CAM table provides a binary result for any query of 0 for true or 1 for false. The CAM is used with other functions to analyze and forward packets very quickly. Switches are built with large CAM to accommodate all the layer 2 hosts for which they must maintain forwarding tables.
RP Failure
The RP switchover triggers a routing protocol adjacency flap that clears the rout table. When the routing table is cleared, the CEF entries are purged, and traffic is no longer routed until network topology is learned and the forwarding table is reprogrammed. Enabling nonstop forwarding (NSF) or nonstop routing (NSR) high availability capabilities informs the router(s) to maintain the CEF entries for a short duration and continue forwarding packets through an RP failure until the control plane recovers.
Which of the following statements best describe an access port on a switch?
The access port is used to provide host-to-switch connectivity The switchport mode can be configured statically Explanation: An access port is typically used to connect a single host device to a switch. The switchport mode can be statically configured for access with the interface command switchport mode access. Frames sent and received on an access port do not have any 802.1Q tags.
SDM Templates
The capacity of MAC addresses that a switch needs compared to the number of routes that it holds depends on where it is deployed in the network. The memory used for TCAM tables is limited and statically allocated during the bootup sequence on the switch. When a section of a hardware resource is full, all processing overflow is sent to the CPU, which seriously impacts the performance of the switch. The allocation ratios between the various TCAM tables are stored and can be modified with Switching Database Manager (SDM) templates. Multiple Cisco switches exist, and the SDM template can be configured on Catalyst 9000 switches with the global configuration sdm prefer {vlan | advanced}. The switch must then be restarted with the reload command.
OUI (Organizationally Unique Identifier)
The first three bytes of a MAC address that uniquely identify a network device manufacturer.
Layer 2 forwarding
The forwarding of packets based on the packets' destination Layer 2 addresses, such as MAC addresses.
Forwarding Information Base (FIB)
The hardware programming of a forwarding table. The FIB uses the RIB for programming.
Checkpointing
The process of mirroring information between RPs is referred as checkpointing. SSO-enabled routers always checkpoint line card operation and layer 2 protocol states.
Routing Information Base (RIB)
The software database of all the routes, next-hope IP addresses, and attached interfaces. Also known as routing table.