CiscoTips

IP Telephony and VoIP Tutorial-Part 1

BlogAdmin — Mon, 08 Feb 2010 18:24:19 +0000

Although this is a Cisco networks dedicated blog, I decided to start a series of tutorial posts about a general technology which is not directly related to Cisco but it is a field in which Cisco is again a major player. This is IP Telephony and Voice over IP (VoIP). The two terms, IP Telephony and VoIP, are related around the same concept but in my opinion they are not exactly the same thing. Many people refer to these two terms interchangeably but they are not exactly the same. So, before moving on lets clarify the difference between IP Telephony and VoIP.

IP Telephony Vs VoIP

IP telephony has to do mainly with digital telephony systems (LAN based IP PBX systems) which use the IP protocol entirely for voice communication. All components of the IP telephony system use digitized voice which is transferred as IP packets through an IP network (usually the LAN network). The telephone handsets (VoIP phones) translate the analogue voice signal into digital voice (binary voice) which is transferred as IP packets from one phone to another. The call control system is usually a software based (softswitch) server which handles all call signaling, call routing, IP phone management etc, again using IP protocol for transport. So think about IP telephony as a bigger concept.

VoIP on the other hand is a subset of IP Telephony. Basically, VoIP is the technology which is used by IP Telephony as the vehicle to transport phone calls. VoIP is the technology in which the analogue voice signal is digitized (analog to digital conversion) and becomes binary numbers in order to be transferred by the IP protocol. VoIP is the basis for the implementation and functionality of an IP Telephony system. VoIP can also be used by legacy TDM based PBX systems to transport voice calls over an IP WAN network or even over the Internet. Special voice gateways are used to connect to the legacy PBX telephone system on one end and to the IP network on the other end in order to translate the TDM voice stream into IP voice packets.

So to summarize, IP Telephony is the overall concept of the modern form of voice communication which harnesses the power and features of VoIP technology in order to offer the overall experience of communicating effectively and with lots of extra features.

Now that we described the difference between IP Telephony and VoIP, let’s see more details about the two concepts:

1. More details about Voice over IP

The term VoIP or Voice over IP refers to the transfer of voice packets over networks based on Internet technology and, more specifically, the IP Protocol. The IP protocol on which the whole Internet is based on was created to implement the transmission of data in the form of data packets. This means that when a data document is transferred over the Internet is cut into small IP packets and sent over the network. When the document reaches its destination, the packets are joined again thus recreating the original document. The same logic applies if the data transferred corresponds to a voice conversation. The voice is digitized, chopped into packets of data transferred over the network via the IP protocol. At the destination the packets are rejoined to recreate the voice stream. Here we should make clear that VoIP refers to the transfer of voice over any IP network. Such a network is the Internet of course, but when considering VoIP it does not necessarily mean that we carry voice over the Internet only. It can be any IP-based network (such as a private corporate WAN network).

2. Packet based (IP Telephony) Vs Circuit Switched Telephone Systems

IP Telephony systems are those using entirely IP packets for voice communication, as explained before. In contrast to packet switched telephone systems (those based on IP protocol), conventional telephone systems apply the logic of direct connection between the two communicating voice parties through a dedicated circuit reserved exclusively for each contact. Thus the term Circuit switched telephone systems. In packet switched systems, however, the same communication line can be used to simultaneously pass different kinds of packets. Thus, the voice packets of one or more conversations may travel through the same route as other packets transferring data, video etc. This is the main difference between traditional telephony which is implemented to the public switched telephone network (PSTN) and telephony implementation on IP networks (or more generally to packet switched networks).

More on IP telephony and VoIP on a future post. Stay tuned.

Prevent Spoofing Attacks on Cisco ASA using RPF

BlogAdmin — Thu, 04 Feb 2010 12:16:48 +0000

A common attack found on TCP/IP networks is IP spoofing. This is usually used for Denial-of-Service, Identity hiding, or even to bypass firewalls or Access-Lists security rules. The spoofing attack works like that:

A malicious attacker sends packets towards a target host.
The attacker disguises itself by inserting a fake source IP into the packet. This fake source IP address in the packet either does not exist at all or it might be a legitimate IP address of some other host located on some other network.
The reply traffic from the target will never reach the attacker because the attacker’s source address is bogus. Therefore the identity of the attacker remains unknown.
This can cause resource-exhaustion on the target host because it will create several “incomplete” TCP connections in its memory.

A Cisco ASA Firewall can identify a spoofed packet by using Reverse Path Forwarding (RPF). RPF can be enabled on a per interface basis. As soon as RPF is enabled on a specific interface, the ASA firewall will examine the source IP address (in addition to the destination address) of each packet arriving at this interface. Normally, any Layer 3 network device examines only the destination address of packets in order to know how to route the packet. By examining also the source IP address of the packet, the firewall can verify if the packet is spoofed or not. The firewall will try to find the reverse route (the path back towards the source) in its routing table. If a reverse route is not found on the interface where the packet arrived, it means that the packet is spoofed and will be dropped immediately.

Lets see the diagram below to clarify the concept of Reverse Path Forwarding:

From the diagram above, an attacker tries to spoof the inside network 192.168.1.0 by using a fake source IP in the packet (fake source IP 192.168.1.1). It sends the packet towards its target host which is 192.168.1.10 (destination address in packet).

On the ASA we have configured RPF on the outside interface as following:

Ciscoasa(config)# ip verify reverse-path interface outside

The ASA will examine the source address of the spoofed inbound packet and will see that source IP 192.168.1.1 belongs to its internal network. A packet with such a source IP should never arrive from the outside interface. Therefore the packet will be dropped. The ASA performs the RPF check by using its routing table. The routing table shows that network 192.168.1.0/24 is towards the inside interface of ASA (assume that we have already configured a static route for this internal network).

Why you must take the Cisco Certifications every three years

BlogAdmin — Thu, 28 Jan 2010 20:06:21 +0000

The world of technology moves at a rapid pace. Once you learn one thing, you can expect that knowledge to be obsolete in a couple of years. The only fields that probably compete with technology in how fast they change is probably being a scientist or maybe even a doctor. If you are a professional in the tech field, it is your job to be on top of new and up coming technologies. This is not to say that you must master everyone of them, but you should at the very least be aware that they are out there. The first time you stop attempting to gain new knowledge in your chosen field, is when you start to become obsolete. The people behind Cisco Certifications reinforce these ideals. Their certifications are only valid for three years. After that you have to be re certified.

When a company decides to back something, they are putting their good name at risk. This is the same when it comes to certifications. The company is basically backing you with their reputation. If you walk around with a badge, advertising that you are Cisco Certified, they want to make sure that you know your stuff. Getting a certification ten years ago and never retaking the test, doesn’t show that you are knowledgeable about the latest technology. If you go to a potential employer and you know nothing about the questions that they are asking you, this makes them have a dim view of the certification itself. A bad reputation then makes the certification useless. Certifications are mostly about impressing the employer, in addition to getting the tech knowledge. If you are not able to do that, then it is worthless.

Some people will complain about too many new trends in technology and not all of them will last. Of course most of them will not last, but that is not the point. You should have known going in that technology is an ever changing field. This is not an unknown fact. It will not stop, just because you wish it to. The field is all about growth and taking ideas to the next level.

Cisco truly cares about their certification process. So much so, that they have set their certifications up with levels. There are five different levels of certifications, they are Entry, Associate, Professional, Expert, and Architect. If you are able to keep up with their technology, you will be able to rise up in levels. Becoming re certified every three years is a perfect way to do this. In that three years span of time, you should have been able to gain a lot more knowledge in your chosen section, so that you would be able to rise a level or two. This takes a large amount of discipline and future employers will recognize that.

Achieving a Cisco Certification every three years will help weed out the people who are not willing to keep up with the latest technology. In the world of tech, it is your job to be able to keep up with the latest developments. If you do not, then you will only be qualified for taking care of older technology. This can help you earn a steady paycheck but not in the most exciting way.

How to choose the best Cisco Certification for your career

BlogAdmin — Fri, 22 Jan 2010 15:28:04 +0000

When it comes to the world of certifications there are many to choose from. It doesn’t matter what area of expertise that you are going in, there will always be sub sections that you will have to know more than others. It is the same in technology. When a company hires you for a tech position, they want to know if you have a broad range of knowledge but also if you are a specialist in the field that they are hiring you for. The one way to show that you are a specialist is by getting a certification in that area. Besides an actual demonstration, there is no better way to prove that you can do what you say you can. The only problem is, what do you want to be your specialty?

When you sit down and decide to get a job in the tech field, you have to really think about what you like the best. Luckily, Cisco offers a wide range of technology that you can specialize in. Their certifications are considered top notch in the industry. Once you have one, there will be a lot of doors opened to you.

Some of the areas that Cisco offers a certification in includes, Data Center, Advanced Routing, Video, Network security, Voice, Wireless and a whole lot of others. There will be something in the group, that you will like more than the others. You have to look at yourself and figure out what you like the best. You will also have to weigh that decision with what employers are looking for in your area. If you are in a major tech hub, then you can most likely study any of these areas and find a job in it. But if you are in a smaller town, then you should really look at the local newspaper and see what the employers in the area are looking for. There is no need to waste time studying for a certification that employers are not hiring for in your area. That is, unless you are willing to move.

There are a lot of Cisco Certifications that are available for you to achieve. It all comes down to two major factors. What are you interested in? Also, what are the employers looking for in your area? If you are able to answer these two questions, then you will be on the road to getting the proper certification that fits best to your own situation.

Cisco Switch Network Design

BlogAdmin — Mon, 18 Jan 2010 16:59:25 +0000

I was browsing the Cisco support forum the other day and found the following question post which is about designing a Cisco switched network. Some useful answers are given, so I thought I would repost here for my blog readers. You will find useful tips about switch port dimensioning, redundancy etc. I Hope you find it useful.

Initial Post Question

Hello all,

I am relatively new to networking and am currently doing some theory work with network design to gain some knowledge. I’m sure you have all been there!!

I have a specification which details the needs for the network across a large campus, including number of users, their bandwidth usage, their locations, overall budget etc. I have chosen what servers are need and their locations, and the number of routers needed and their connectivity to each other to build in redundancy. My next step is to calculate how many switches will be needed for each building to get all the users onto the network and this is where I am getting quite confused.

My understanding is that a host connects to one port on the switch and a standard switch has generally around 24 ports. Therefore one switch can theoretically connect only 24 users to the network (perhaps 23 if one of those ports are used to connect to the router). My problem is that is some buildings I have over 400 users (Ive added a small percentage to allow for growth of the company). Does this mean that I need one switch to connect to the router and then another switch on each of the 24 ports to have enough ports to connect this many users? If this or something similar is true how is redundancy built in because if the switch that connects to the router goes down all the users in that building lose their connection. This seems a very expensive solution and probably quite an ugly one.

If anybody could guide me through a solution it would be very much appreciated. I have spent a long time reading articles and such on the internet but nowhere seems to go though this so if you know of a resource that walks you through design a medium/large network that would be great.

Many thanks in advance
Darren

Reply 1

Hi Darren,

To answer a couple of your points, you can get access switches with 48 ports (Cisco 2960 or 3560 for example).
If you have 400 users in a building, will all 400 user locations be cabled back to a single network cabinet (closet)?
If they are then you may be better off looking at a chassis based switch such as the 4500 series for example.
If not, you might want to to distribute the access switches in different cabinets around the building and link them back to a central distribution switch or router.
The final design will depend on the physical size of the building because don’t forget that you are restricted to 100 meters of UTP cabling between the user outlet port and the switch.

Hope that gives you some pointers.

Pete

Reply 2

Hi Darren,

To have redundancy in network you should have redundant pair of devices in your network to support redundancy and to support 400 users you can have chassis based switches with ethernet modules to support more number of users.

with you setup redundancy will be the main question as one router and local lan so the switch which is connected to router goes down then network outage.

The better way is to have dual router and dual switch in bundling mode and connect a cris cross cable between router and switch to have full redundancy in your network.In this fashion you can achive full redundancy and no network outage if any one of the device goes down.

Hope that helps out your query !!

Regards

Ganesh.H

Reply 3

Hello Darren,

IMHO the design is mainly dependent on how the connectivity and the requirements per floor( if any). If there is a per floor cabinet then may be you can use C3750 stack for access layer solution per floor.To increase any capacity needs you just keep adding to the stacks. Then if there is fiber wiring between floors available you can chose to interconnect access layer and distribution using that. Say one closet/cabinet on any floor as the collapsed distribution model, the choice is vast here c3750/4500/6503. The access layer c3750 do come with 48 ports and 4 SFP based uplink ports. so you can use the sfp based uplink ports to connected these back to your collapsed distribution layer, which becomes your default gateway and may be the STP root port too. Now for redundancy, IMHO the access layer needs to be dual connected to a redundant gateway model (each acccess stack connected to both gateways) as Ganesh suggested earlier. You can either use HSRP/VRRP to provide L3 gateway redundancy. You can also use etherchannel for uplinks to provide more redundancy. Of course if one switch fails in the stack then we loose those ports, but still the other switches on the stack will work. this is just my thoughts on you requirements.

Hope that helps.

Deesh

CWNA Certification-Certified Wireless Network Administrator

BlogAdmin — Tue, 12 Jan 2010 15:01:12 +0000

Click Here for the ONLY Authorized Video Training for CWNA.

Wireless technology is a rapidly expanding market. The Wi-Fi standard (802.11), which is the defacto technology for wireless LANs, is continuing to evolve over time and has been embraced by almost all networking vendors and by many electronic hardware vendors. Wi-Fi technology has brought “Freedom and flexibility in Communication”. With wireless technology, people have more flexibility and more freedom to connect with their favorite content and to communicate with others even when they are on the move. All sorts of devices support now the wireless technology. From computers, media players, game consoles, mobile phones etc. Wireless is everywhere. Without the cumbersome cables, people’s communication and connectivity is now simpler and easier.

I.T professionals with wireless knowledge, skills, and qualifications are earning more money than others in the technology field. A “CertMag” salary survey showed that I.T professionals holding a CWNA (Certified Wireless Network Administrator) or CWSP (Certified Wireless Security Professional) certifications earn considerably more than many other technology certifications.

An excellent, vendor-neutral, certification to pursue is the CWNA (Certified Wireless Network Administrator). This is a foundation level certification under the CWNP program. The CWNP is the industry standard for certifications in the wireless LAN industry. A CWNA certification is the initial step towards a successful career in the wireless field. Because it is vendor-neutral, you have the advantage of being employed by any company or organization having any wireless infrastructure vendor. A CWNA professional has the technical leadership and the ability to successfully implement any wireless solution and offers a career differentiation, with enhanced credibility and marketability.

CWNA Training and Preparation

For optimal CWNA preparation I suggest to get the only authorized CWNA Video Training (from Trainsignal) together with the Official CWNA Self-Study Guide (709 pages paperback) from the official website (cwnp.com). The combination of the two study resources above will definitely help you to pass the exam guaranteed. Especially the Trainsignal Video Training package, will provide you with an “instructor-like” experience which covers all required topics for the exam. The instructor in the videos, Ed Liberman, is a technology guru with 18 years experience in the I.T field and 12 years as an instructor

CWNA Exam Details

To earn the CWNA certification you must pass the CWNA PW0-104 exam. This is a multiple-choice exam with 60 questions, for 90 minutes exam duration. You need a passing score of 70%. You can register at Pearson VUE to take this exam (www.vue.com).

The certification exam measures your ability to administer any wireless LAN. The exam covers a broad range of wireless LAN topics focused on 802.11 wireless technology rather than products of specific vendors. The main topics covered by the exam are the following:

Radio Technologies
Antenna Concepts
Wireless LAN Hardware and Software
Network Design, Installation, and Management
Wireless Standards and Organizations
802.11 Network Architecture
Wireless LAN Security
Troubleshooting
How to Perform Site Surveys

The full exam objectives are shown here: http://www.cwnp.com/exams/pw0104_objectives.pdf

Forwarding a DHCP Request using Cisco ip helper-address command

BlogAdmin — Thu, 07 Jan 2010 14:45:52 +0000

DHCP, as we all know, is a broadcast protocol (shame on you if you don’t know that already !!) which normally works only on the same Layer 2 broadcast domain. Does this mean that you need to have your DHCP Server connected to the same network subnet as the DHCP clients? If this was the case it would not be flexible or economical at all. What if you have segmented your internal network into many different subnets and you have DHCP clients in all those subnets. Would this mean that you must have a DHCP server for every subnet? Fortunately, you don’t need to have this situation. With the Cisco “ip helper-address” command configured on the Layer3 interface which receives the client’s DHCP broadcast, you can transform the broadcast request into a unicast and send it to a centralized DHCP server which can be located to a different subnet in your network. The unicast DHCP request will be routed normally to the destination DHCP Server within the network, even if the server is far away from the DHCP client.

The DHCP server must have an appropriate IP Pool scope configured for the specific subnet from where the DHCP request came. Using this IP scope, the server will assign an appropriate IP address to the requesting client. For example, if the DHCP client subnet is 192.168.1.0/24, then the remote DHCP server must have an IP Pool configured to assign addresses within the range 192.168.1.0/24. The source DHCP client subnet is determined by the IP address assigned to the Layer3 interface which has the ip helper-address configured.

Let’s see an example scenario below with a configuration snapshot.

From the network diagram above, two DHCP client PCs are located behind Router A. Interface Fe0/0 of the router has IP address 192.168.1.1/24. The DHCP clients will start broadcasting DHCP requests in order to get their IP address information assigned from a server. By default, these DHCP broadcast requests will be confined within Switch A and will never reach any other subnet beyond Router A. By configuring an “ip helper-address 10.10.10.1” under interface Fe0/0 of Router A, we tell the router to turn the DHCP broadcast into a DHCP unicast and send it to destination DHCP server 10.10.10.1. The server will see that the DHCP request came from source subnet 192.168.1.0/24 and will therefore assign an appropriate IP address from a configured IP pool scope within the range 192.168.1.0.

Configuration on Router A

RouterA# conf t
RouterA(config)# interface fastethernet0/0
RouterA(config-if)# ip address 192.168.1.1 255.255.255.0
RouterA(config-if)# ip helper-address 10.10.10.1

Some other important considerations for ip helper-address

By default, the ip helper-address command forwards also some other broadcast protocols in addition to the DHCP (BOOTP) protocol. It forwards by default the following eight UDP broadcast protocols:

UDP 37 (Time protocol)
UDP 49 (TACACS)
UDP 53 (DNS)
UDP 67 (DHCP Server)
UDP 68 (DHCP Client)
UDP 69 (TFTP)
UDP 137 (NetBios)
UDP 138 (NetBios Datagram service)

If you want to add more broadcast protocols to be forwarded, or even remove some of the default forwarded protocols, you can use the “ip forward-protocol” command under global config mode.

Example: Remove the NetBios protocols (137,138) from being forwarded by default, and add NTP protocol 123 to be forwarded by ip helper-address.

RouterA(config)# no ip forward-protocol udp 137
RouterA(config)# no ip forward-protocol udp 138
RouterA(config)# ip forward-protocol udp 123

Happy New Year 2010

BlogAdmin — Fri, 01 Jan 2010 21:08:31 +0000

I wish to everyone of you to have a great new Year 2010. May you have health, happiness, prosperity in your life and Peace in your heart.

Best Regards

Harris Andrea

Most Popular Blog Posts for 2009

Most Popular Blog Posts for 2009

BlogAdmin — Sun, 27 Dec 2009 16:17:34 +0000

As the end of the year is almost here, I have decided to make a round-up of my blog posting activity for year 2009. I have gathered the 3 most popular posts for my blog in 2009 and listed them below. It seems that anything related with Cisco ASA Firewalls is very popular. This is because the Cisco ASA configuration is kind of difficult to comprehend, especially for beginners in the field of network security. Not only that but also official documentation for Cisco ASA is unfortunately limited to mostly description of configuration commands and explanations for only a small fraction of the huge feature list of the Cisco ASA. Therefore people are searching the web for more information and solutions about their network firewall implementations. Another popular topic is Cisco switches. Although a switch is sometimes considered a plug-and-play device, I’ve got hundreds of hits on two posts related with Vlans and Layer3 functionality on a Cisco switch. Let’s see the three most popular posts that received the most hits for 2009:

Trainsignal CCNA and CBT Nuggets CCNA Training-Two Great Options

BlogAdmin — Tue, 22 Dec 2009 14:35:23 +0000

In my workplace (I work in an ISP provider in Europe) we always encourage junior network engineers to follow a Cisco certification path, either through the Routing and Switching path or other important technology paths such as network security and VoIP. I have been in this industry for more than a decade and I firmly believe that in order to succeed in the networking professional career one must earn relevant professional certifications.

Cisco is one of the leader companies offering professional certifications, which are highly recognized in the industry as excellent qualifications for an employee. Earning a Cisco certification means that you have a good grasp of the technology and most importantly you are competent to design and implement Cisco solutions and products. The Cisco Certified Network Professional (CCNA) certification is the entry level qualification and is very popular among junior engineers. To pass CCNA you need a high quality training and dedication towards your goal.

There are several training options available for CCNA preparation, such as self-study via books, instructor based training (boot camp style), video training, simulation exams etc. From my own experience when studying for my Cisco exams, and also from discussions with other certified colleagues, one of the best ways to study for CCNA is using a CCNA Video Training package. Especially when you combine a video training package with exam practice questions, you will have a complete preparation method for passing your exam. A video training package includes DVD quality videos with a real instructor teaching the course and guiding you through the exam objectives to help you pass.

The two best companies offering CCNA Video Training packages are Trainsignal and CBT Nuggets. Both training companies offer top-quality material and are very popular among technology professionals since they offer a wide range of vendor trainings (Microsoft, Cisco, CompTIA, VMWare etc). Especially for CCNA certification, the video training product from these two companies is an excellent choice. The two instructors (Chris Bryant for Trainsignal training and Jeremy Cioara for CBT Nuggets training) are highly experienced teachers who will help you tremendously to learn the CCNA material. Go ahead and check out those two training options and I’m sure you will not get disappointed. I have prepared also a comparison table between Trainsignal Vs CBT Nuggets for getting a better idea of the two training packages for CCNA.