10% 4.0 Network Assurance
4.1 Diagnose network problems using such as debugs, conditional debugs, traceroute, ping,
SNMP, and syslog
Ping, traceroute, debug command, make access lists to filter better, undebug all command to remove all, syslog
4.2 Configure and verify Flexible NetFlow
Capture statistics on who talked to who, how they did, and how much
Statistics available per host
Conf t, ip flow-export version #, flow-export destination [IP]
Navigate to interface, ip flow egress, ip flow egress
Show ip flow interface, export, show ip cache flow, ip flow-top-talkers (why the hyphen LOL>??)
WHO talked to WHO, HOW, and HOW MUCH
4.3 Configure SPAN/RSPAN/ERSPAN
Same switch, SPAN = Switched Port Analyzer, connect to and configure the switch to duplicate the traffic to another interface
Remote different switch, RSPAN = Remote Switched Port Analyzer, remote switch sends traffic back to local switch, same layer 2 domain, basically source and destination ports can be on different switches. Send RSPAN traffic over RSPAN vlan. On source switch, Source is interface, destination is remote vlan [number]. Reverse is true for the destination switch.
Make sure you hit the “remote-span” command on vlan configuration mode
Remote different device ERSPAN = Encapsulated Remote Switched Port Analyzer, remote device captures and then encapsulates using GRE back to the local network
Switch(config)# monitor session [number] source interface [interfacesSwitch(config)# monitor session [ number] destination interface [interface SPAN device is connected to]switch#Show monitor session [number]
4.4 Configure and verify IPSLA
Service provider SLA tracking only provides SLA information within their network. You can use Cisco IPSLA to measure end-to-end SLA. Works as a constant steady stream of ICMP pings (or HTTP messages, if configured that way), measuring specific stats
- Delay (round trip and one way)
- Jitter (per direction)
- Packet loss (per direction)
- Packet sequencing (fragmented packets arriving in order?)
- Path
- Connectivity (per direction)
- website download time
- voice quality scores
5.4 Describe the components of network security design
5.4.a Threat defense
5.4.b Endpoint security
5.4.c Next-generation firewall
5.4.d TrustSec and MACsec
Trustsec= apply rules by security group – devices and users are joined to groups, and these groups are used to make policies (eg guest cannot connect to anything NOT guest)
MACsec aka 802.1AE = layer 2 traffic is only encrypted as it travels, and not in the switch. This allows inspection of the payload itself inside the switch
Downlink MACsec = encryption of layer 2 traffic between an endpoint and a switch (requires both devices to be MACsec capable. Devices can be configured with ISE or manually per port
Uplink MACsec = encryption of layer 2 traffic between switches
