Title: ICND2 / 5. WAN Technologies

Q: In regards to Frame Relay, what is meant by CIR?
A: CIR is the Committed Information Rate; the minimum amount of bandwidth you're going to get on a link.

Q: In regards to Frame Relay, what is meant by PVC?
A: PVC is a Permanent Virtual Circuit; a software-defined logical connection. A PVC is provisioned in order to last from a month to several years, or until the service is terminated.

Q: What is a LAR?
A: A Local Access Rate is how fast a connection is physically capable of transmitting data.

Q: What is meant by LMI (Frame Relay)?
A: Local Management Interface is a form of signaling.  It is the signaling between (your) router and the Service Provider.  It gives a language for the SP to speak to your router and deliver the list of DLCIs that it may have and other statistics.  It is the language between the SP and your router.
LMI comes in three different langauges:
Cisco
Ansi
Q933A

Q: What is a DLCI?
A: Data Link Connection Identifier.  The layer 2 addressing used by Frame Relay. The DLCI is locally significant.

Q: With Frame Relay, if you do "R1#show frame-relay pvc" and get a status of inactive, what does this mean?
A: The other side of your DLCI is not working for some reason.
Check your mapping from the opposite side to you

Q: With Frame Relay, if you do "R1#show frame-relay pvc" and get a status of deleted, what does this mean?
A: It means you are trying to use a DLCI that the SP has no record of.
Even if the SP gave it to you, it's possible they deleted it before you started using it. Or you could have created your own map with DLCIs that didn't exist.

Q: What is Inverse Arp?
A: Resolves IP addresses From Layer 2 (DLCI) addresses.

Q: How would you turn off Split Horizon? (if you needed to disable it for a multi-point Frame Relay configuration)
A: ROUTER1(config-if)#no ip split-horizon eigrp <AS#>

Q: When configuring the frame relay switch, do the interfaces need to have an IP address?
A: No.  But the interface line-protocol needs to be up (no shut)

Q: What command produced the following output?:
PVC Statistics for interface Serial0/0/0 (Frame Relay DTE)
              Active     Inactive      Deleted       Static
  Local          1            0            0            0
  Switched       0            0            0            0
  Unused         0            0            0            0
DLCI = 201, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0/0/0.201
  input pkts 19            output pkts 16           in bytes 2904
  out bytes 1887           dropped pkts 0           in pkts dropped 0
  out pkts dropped 0                out bytes dropped 0
  in FECN pkts 0           in BECN pkts 0           out FECN pkts 0
  out BECN pkts 0          in DE pkts 0             out DE pkts 0
  out bcast pkts 1         out bcast bytes 327
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
  pvc create time 00:01:36, last time pvc status changed 00:01:36
A: R2#show frame-relay pvc

Q: What command produced the following output?:
Input Intf      Input Dlci      Output Intf     Output Dlci     Status
Serial0/0/0     102             Serial0/1/0     201             active
Serial0/1/0     201             Serial0/0/0     102             active
A: FR_SWITCH#show frame-relay route

Q: What command produced the following output?:
Serial0/0/0.201 (up): point-to-point dlci, dlci 201(0xC9,0x3090), broadcast
          status defined, active
A: R2#show frame-relay map

Q: On a client router, after you set the interface encapsulation to frame-relay, what do you need to do when creating the sub-interface?
A: specify whether or not you are using a multipoint or point-to-point link. For example:
R1(config-if)#int se0/0/0.102 point-to-point

Q: _____ status messages perform two key functions:
• They perform a keepalive function between the DTE and DCE. If the access link has a problem, the absence of keepalive messages implies that the link is down.
• They signal whether a PVC is active or inactive. Even though each PVC is predefined, its status can change. An access link might be up, but one or more VCs could be down. The router needs to know which VCs are up and which are down. It learns that information from the switch using LMI status messages.
A: LMI

Q: How would you manually change the LMI type?
A: FR_SWITCH(config-if)#frame-relay lmi-type cisco|ansi|q933a

Q: What does LAPF stand for?
A: Link Access Procedure Frame Bearer Services. Defines the basic Frame Relay header and trailer. The header includes DLCI, FECN, BECN, and DE bits.

Q: What command lists the information learned by Inverse Arp?
A: R1#show frame-relay map
Serial0/0/0.102 (up): point-to-point dlci, dlci 102(0x66,0x1860), broadcast
          status defined, active

Q: Does Cisco IOS automatically sense the LMI type when configuring Frame Relay?
A: Yes.

Q: If your Frame Relay network is configured to use a single subnet, do you need to configure sub interfaces on the DTE routers?
A: No. If you also design the Frame Relay network to use a single subnet, you can configure the routers to use their physical interfaces without any subinterfaces—making the configuration shorter.

Q: How would you change the Frame Relay encapsulation type from cisco to ietf?
A: R1(config-if)#encapsulation frame-relay ietf

Q: When configuring Frame Relay, if you aren’t using the (default) Inverse ARP to map the DLCI to the next-hop router’s IP address, define static mapping using the ___________________________________________ subinterface subcommand.
A: frame-relay map ip <ip-address> <dlci> broadcast

Q: What is the default encapsulation protocol used by routers over a WAN link?
A: HDLC (High-Level Data Link Control)

Q: With a multi-point Frame Relay configuration, how would you deal with different encapsuation settings (ietf and cisco) on two different virtual circuits that use the same DTE interface?
A: R1(config)#itnerface se0/0/0
R1(config-if)#frame-relay map ip <dest.ip.addr.x> <dlci> ietf
R1(config-if)#frame-relay map ip <dest.ip.addr.x> <dlci> cisco

Q: When configuring Frame Relay, if you manually configure the LMI type (R2(config-if)#frame-relay lmi-type ansi), will autosense still work?
A: No. When you set the lmi-type, autosensing becomes disabled.

Q: What is the process of frame relay mapping?
A: Frame Relay mapping matches a next-hop IP address that sits on the Frame Relay network with the right DLCI used to send frames to that next-hop device, with the same goal as ARP on a LAN.

Q: What command would you use to see your Frame Relay mappings?
A: R1# show frame-relay map
Serial0/1/1 (up): ip 199.1.1.2 dlci 52(0x34,0xC40), dynamic,
broadcast,, status defined, active
Serial0/1/1 (up): ip 199.1.1.3 dlci 53(0x35,0xC50), dynamic,
broadcast,, status defined, active

Q: In regards to Frame Relay, how does Inverse ARP work?
A: Inverse ARP announces its Layer 3 addresses as soon as the LMI signals that the PVCs are up. Inverse ARP starts by learning the DLCI data link layer address (via LMI messages), and then it announces its own Layer 3 addresses that use that VC. Inverse ARP is enabled by default.

Q: R1(config-if)#frame-relay map ip 199.1.1.1 51 broadcast
In the above command, what is the purpose of the broadcast keyword?
A: The broadcast keyword on the frame-relay map command is required when the router needs to send broadcasts or multicasts to the neighboring router—for example, to support routing protocol messages such as Hellos.

Q: Atlanta(config-subif)# frame-relay interface-dlci 54
In the above command, what is the purpose for the "interface-dlci" keyword?
A: Cisco IOS software needs to associate the correct PVC with the correct subinterface. This is accomplished with the frame-relay interface-dlci command.

Q: How can you enable debugging for LMI?
A: Router#debug frame-relay lmi

Q: Can OSPF routers become neighbors over a Frame Relay physical interface or a multipoint subinterface if using only the base OSPF configuration
A: No.
Routers using OSPF do not become neighbors over a Frame Relay physical interface or a multipoint subinterface if using only the OSPF configuration.
Frame Relay physical and multipoint subinterfaces, by default, use an OSPF network type of nonbroadcast. This OSPF network type means that the router will not attempt to dynamically discover any OSPF neighbors on that interface.
If using OSPF, all three routers should become OSPF neighbors. To make OSPF work between those routers, besides the expected OSPF configuration to enable OSPF on the multipoint subinterface of each route, use the ip ospf network point-to-multipoint command on all three router’s multipoint subinterface. This command changes the OSPF network type to point-to-multipoint, which tells each router to dynamically discover neighbors (and to not use a designated router / backup designated router [DR/BDR]).
R2(config-subif)#ip ospf network point-to-multipoint

Q: What is a Remote Access VPN?
A: People working from home or on the road and they need to connect to the "corporate network" over the Internet.

Q: What is a Site-to-Site VPN?
A: An office in Japan connecting to a corporate office in Arizona over the Internet. A replacement for a WAN connection.  MUCH cheaper than a WAN link.

Q: Why wouldn't you want to use a VPN?
A: Quality of service is not guaranteed.  Leased lines quality is guaranteed.

Q: What must a VPN provide?
A: Authentication; Are you who you say you are?
Integrity; Data hasn't been altered
Confidentiality; Encryption
Anti-Replay; Re-send old packets and let them Authenticate
All of these are solved by IPSec.

Q: What are some examples of Negotiation Protocols that IPSec uses?
A: AH
ESP
ESP+AH

Q: What are some examples of Encryption that IPSec Supports?
A: DES, 3DES, AES

Q: What are some examples of Authentication Methods that IPSec provides?
A: MD5
SHA-1

Q: What are some examples of Replay and Secret Key Protection that IPSec Provides?
A: Diffie-Hellman Group 1,2,5,7

Q: When considering a VPN fully protected with IPSec and strong encryption, where should your concern be focused?
A: Since encryption protocols are capable of being "Very strong", the most likely spot for a break in security is the hosts at the end.  Those need to be locked down and secured as well as possible.

Q: What is BECN?
A: When frames arrived at a router with the Backwards Explicit Congestion Notification (BECN) bit set, congestion was encountered in the opposite direction from which the frame was traveling. This bit is set by the Frame Relay switch. If an incoming packet has the BECN bit set, then this indicates congestion in outgoing packets, so the router will experience congestion in sending frames.

Q: What is FECN?
A: When a Frame Relay switch encounters congestion, it will mark packets being sent in both directions on a PVC with either the Forward Explicit Congestion Notification (FECN) or the BECN bit set. It will set the BECN bit on packets headed in the opposite direction of the congestion and FECN in the same direction as the congestion. When a packet with the FECN bit is received by a router, it means there will be congestion when the receiving router receives packets.

Q: What is DE (frame relay)
A: A third type of marking is the Discard Eligibility (DE) bit. When this bit is set on a packet, it ensures that if congestion occurs and packets need to be discarded, the packet with the DE bit set should be discarded first. ALL packets in excess of the committed information rate (CIR) are marked with the DE bit.

Q: ________ VPNs connect sites in different but cooperating companies.
A: Extranet

Q: ____________ refers to a VPN that uses the Internet to connect the sites of a single company rather than using leased lines or Frame Relay.
A: Intranet VPN

Q: What is a GRE tunnel?
A: Generic Routing Encapsulation tunnel.
GRE was developed as a tunneling tool meant to carry any OSI Layer 3 protocol over an IP network. In essence, GRE creates a private point-to-point connection like that of a virtual private network (VPN).
GRE works by encapsulating a payload -- that is, an inner packet that needs to be delivered to a destination network -- inside an outer IP packet. GRE tunnel endpoints send payloads through GRE tunnels by routing encapsulated packets through intervening IP networks.

Q: What command would you use to create a tunnel interface on a Cisco router?
A: R1(config)#interface tunnel 0

Q: How many headers does GRE specify?
A: GRE defines its own header, used to manage the tunnel itself. GRE also defines the use of a complete 20-byte IP header, called the delivery header. This header will use IP addresses from the unsecure network. In this case, the delivery IP header will list R1’s 1.1.1.1 Internet IP address as the source and R2’s 2.2.2.2 Internet IP address as the destination.

Q: How do public network (Internet) routers route a GRE packet to its destination?
A: While the packet passes through the Internet, the routers in the Internet use the outer GRE delivery IP header to route the packet. The fact that the packet happens to hold another entire IP packet inside does not matter to the IP forwarding process in those routers; they just forward the IP packet based on the destination IP address in the GRE delivery IP header.

Q: If you traceroute over a VPN will you see the internet hops as output?
A: No.  The traceroute does not list any routers in the unsecure part of the network (Internet), because the packets created by the traceroute command get encapsulated and sent from R1 to R2, just like any other packet.

Q: How would you set up a leased line with CHAP authentication between two routers?
A: Create usernames/accounts and passwords on both routers that correspond to eachother's username
Set up the serial interface and choose your protocol
Set the Autentication
Bring the interface up
R1(config)#username R2 password Password1
R1(config)#int se0/0/0
R1(config-if)#clock rate 2000000 (DCE SIDE)
R1(config-if)#ip address 192.168.2.1 255.255.255.0
R1(config-if)#ppp authenticaiton chap
R1(config-if)#encapsulation hdlc||ppp||frame-relay
R1(config-if)#no shut
R2(config)#username R1 password Password1
R2(config)#int se0/0/0
R2(config-if)#ip address 192.168.2.2 255.255.255.0
R2(config-if)#ppp authentication chap
R2(config-if)#encapsulation hdlc||ppp||frame-relay (MATCH DCE SIDE PROTOCOL)
R2(config-if)#no shut

Q: (OSPF)What is a Virtual Link?
A: A Virtual Link is like a VPN connection.  It is used when you cannot connect an OSPF area directly to Area 0 (the backbone).

Q: When setting up frame relay, do you have to create frame-relay routes on each end of the PVC?
For example, is this necessary?:
FR_SWITCH(config)#int se1/0
FR_SWITCH(config-if)#frame-relay route 102 interface s1/1 201
FR_SWITCH(config-if)#int se1/1
FR_SWITCH(config-if)#frame-relay route 201 interface s0/1 102
A: Yes.  You have to create a street going both ways otherwise the PVC will be listed as "inactive"

Q: (IPSec)What seems to be the difference between transport mode and tunnel mode?
A: Tunnel mode seems to be between two routers or firewalls.
Transport mode seems to be between an end-station and a VPN gateway.

Q: Which protocol is responsible for negotiating and maintaining Point-to-Point Protocol (PPP) connections?
A: Link Control protocol (LCP) has the primary responsibility of negotiating and maintaining a PPP connection.

Q: What is NCP?
A: Network Control Protocol (NCP) is responsible for negotiating upper-layer protocols that will be carried across the PPP connection.