All right, and now it's time to dive into the actual material.
So the first discussion we're going to have or major discussion we're going to have is all about access and distribution layer features and services.
So we're going to cover a lot of different topics in this major discussion.
We're going to be focusing on VLANs, trunks, VTP, inter-VLAN routing, STP in three different flavors, Ether channel bundling, first hop redundancy protocols like HSRP, VRP, GLBP, and then we'll be done.
And then we'll have to move on to what? Routing at that point in time, which is more about our distribution slash core features.
All right, so let's get this party started and let's dive into a discussion here on campus architecture first.
Why? Because we just have to remind ourselves what our campus typically looks like because as we're going to be working with all these different technologies,
it's important that we have an understanding of what is going on under the scenes with that layout and that architecture.
So the architecture we typically use is the Cisco Enterprise architecture model.
And first of all, what does this model gives us? Well, it's very, very, very modular in nature.
You'll see we have the access layers, the distribution layers, the core layers, and how everything's interconnected together gives us this modularity.
Why? So that way there are services and functions can be designated to very specific areas.
So, for example, in this part of our network. Yeah, technology is not working today. Wonderful.
All right. So in this part of our network here, as an example, we'll be using things like VLAN, spanning tree protocol.
We'd have our first top redundancy protocols here.
We'd do some ether channel bundling here and so on and so forth, as well as a multitude of other other services and functions that we can implement in that part of our network.
Whereas, you know, in this part of our network, we might be using something like OSPF or using something like EIGRP in this part of our network.
And over here, we might be using BGP between our offices, a lot of different options that we have.
But you'll see that by having this more modular environment,
we can have different services and functions designed for very specific purposes within very specific modules,
therefore essentially giving us this compartmentalized way of building our infrastructure.
So in the end, what does it do for us? It isolates failures for the rest of our network.
So that way there, if something happens here, we can contain it there.
If something happens over there in the data center, we can contain it there.
If something happens down here, we can contain it down there.
So a failure in, for example, the access layer should not affect the distribution layer.
A failure in the distribution layer shouldn't affect the access layer or the core.
So any failure anywhere should not affect anything else or anyone else.
In addition, this is all about what type of traffic flow.
It's about north self-traffic flow, north self-traffic flow.
So north self-traffic flow means in and out, in and out of your subnets, in and out of your VLANs, in and out of your broadcast domains.
That is north self-traffic flow.
What's the opposite of that? East and west traffic flow.
So east and west traffic flow would be traffic within a subnet, within a VLAN, within a broadcast domain.
So typically we see a lot of east-west traffic flow where, folks, can anybody tell me?
Where do we typically see a lot of east-west traffic flow?
Yeah, in our data center.
So I have a bunch of servers in my data center that you can see on the left-hand side.
So a lot of times we're going to have servers talking to each other.
Why? Because of the way we design our servers and our services nowadays.
We have a lot of microservices, and they run on different systems, different servers, different virtual machines, different containers.
And as a result of that, we have a lot of east-west traffic flow.
So, for example, you might be sitting here, and you're going to do a lot of north-south communication with who?
You're going to do a lot of north-south communication with your servers.
But the servers are going to do a lot of what?
The servers are going to do a lot of east-west discussing, talking with each other.
So just keep that in mind for the exam, the difference between north-south traffic flowing in and out of those subnets,
in and out of those VLANs, in and out of those VLANs.
So just keep that in mind for the exam, the difference between north-south traffic flowing in and out of those subnets,
in and out of those VLANs, in and out of those broadcast domains,
whereas your east-west traffic flow would be communication within your subnets, within your VLAN broadcast domains.
And typically, end stations are not going to be talking to each other within the same subnet VLAN broadcast domain.
When you think about a PC, who does a PC talk to like 99% of the time?
Some device outside of its subnet VLAN broadcast domain.
As a result of that, typically, end users are going to be north-south traffic flow,
going to some server, some system, somewhere.
But the servers are going to be doing a lot of east-west communication with themselves.
This entire enterprise architecture needs to be what?
Always available, always on.
So how do we get that?
A lot of redundancy.
So we've got redundancy at the distribution layer.
We've got redundancy in our links.
We've got redundancy for the WAN.
We've got redundancy for the Internet.
We've got redundancy in our data center.
We've got redundancy everywhere.
We need to ensure we have a lot of layers of defense here.
So defending at the edge, but also what?
Defending in and out of our subnets, in and out of our data centers.
So ensuring that we implement those defenses
and traditional defenses where are typically going to be at the distribution layer.
And it could be something as simple as an ACL.
We could put a firewall there as well.
But the idea here is to make sure that we're controlling the flow of traffic in and out of those subnets,
in and out of those VLANs, in and out of those broadcast domains.
Same thing at the edge of our environment.
The mentality of that is slightly changing as well with the new zero-trust architecture.
If you've never heard of that, you might want to look it up.
The zero-trust architecture is zero-trust, always verify.
And as a result of that, instead of just relying on these security mechanisms based on location,
based on IP addressing, that's what we have basically, a lot of us,
is security based on location, based on IP address.
With zero-trust, we are going to be essentially shifting that security model.
Instead of it based on location and based on IP, it's going to be based on what?
The contextual identity of a device and a user and an app.
And as a result of that, the control mechanisms are put into place.
Instead of that geographical boundaries, they're going to be put in place basically right there on you
when you are trying to communicate.
So, if I have a PC here and I'm trying to communicate, I'm going to be controlled right here.
Right here, traffic is not even going to be allowed to get into the network unless it's 100% approved
based on the contextual identity of the device, the security posture of that device,
the user that's using that device, the app that's on that device, and is it updated, so on and so forth.
And then the end result is that a lot of the perimeter security mechanisms are not necessary,
although we're not going to get rid of them, but they're not as necessary
and we're not relying on them to be our only line of defense.
We're relying on the fact that, hey, if a user is trying to do something,
that has to be authenticated, authorized, approved at that very specific moment in time,
so everything you do.
So, that is a zero-trust architecture.
And later on in this course, and I bring this up because later on in this course,
you're going to learn about something called TrustSec.
If you know about TrustSec, say, I, type in I.
If you know about TrustSec, TrustSec is actually part of Cisco's zero-trust architecture solution.
That's what it is.
And the end result is that you are going to be securing your environment
based on every single communication that happens, and not just based on location,
not just based on IP address.
It's going to be based on a whole bunch of different variables and attributes
that go into the overall decision-making process.
And TrustSec is part of our SD-Access solution.
How many of you are using SD-Access?
And typically, you're going to use something like Identity Services Engine in order to accomplish that.
So, we're going to learn a lot of the fundamentals.
We're going to learn an excessive amount of fundamentals throughout this course.
But then towards the end of this course, I'm going to introduce you to something like SD-Access,
something like TrustSec, something like Identity Services Engine,
because you will be testing on those in the certification exam as well.
That's why I'm bringing them up here.
You're going to see them later on in this particular course.
So, it's going to shift our mentality when it comes to security when it's all said and done.
And last but not least, this has to be extremely scalable, and it is.
This is extremely scalable because at any point in time, if we have to add another,
let's say, access layer switch down here, I can connect it here, I can connect it here, I'm done.
If we want to go ahead and we need another distribution layer somewhere,
set up your distribution layer, connect it up to the core, core, core, core,
and then put our access layer switches down here.
So, very, very scalable, very flexible.
Now, if you're interested more in design, if you love design, you love architecture,
then you want to take a look at going out to Cisco's website right now.
Oops, got to go back one more page.
All right.
So, this one right here, 300.420, prove your knowledge of enterprise design,
including advanced addressing and routing solutions, advanced enterprise campus networks,
WAN, security services, network service, SDA.
So, this is all about designing.
So, if you're into designing, you want to learn more about designing,
that's the place to go to learn more about designing.
300-420-ENSLD, as I like to call it.
So, you'll notice here that we have different tiers.
You've got the access layer, you've got the distribution layer, you've got the core,
you've got access layer, distribution core, you've got access distribution core,
access distribution core.
So, let's just zoom in on one section.
So, that way there we can just focus on access, distribution, and core.
So, I think you can already see how the core just connects everything together.
The core provides fast transportation between different distribution areas that you have
within your enterprise campus.
A lot of people think that the core is going to have all the services in it,
and in actuality, the core has minimal services in it
because we don't want the core to be having to do work.
We want the core to be all about fast transportation and nothing else.
So, typically, we're not going to be putting security solutions in the core.
We're not going to be putting traffic filtering solutions in the core.
We're not going to be putting those things that could slow down our communication flow
when it's going through the core.
We want the core to be as fast as possible.
So, typically, when it comes to features and services, they're being applied where?
At the distribution layer.
They're being applied at the access layer.
That's typically where we are applying our solutions.
So, the access layer is providing workgroup and user access to the network.
We have the distribution layer.
That's all about policy-based connectivity.
So, in our typical modern, not modern day, but our typical enterprise networks
where we're not using newer advanced technologies and solutions,
where do we typically put our security?
Right here at the distribution layer.
It's where we have our policy-based connectivity,
our policy-based control to control traffic as it's flowing from here up to here
or flowing from here down to here.
We're going to control it all right here.
But there's other ways to do this.
For example, when we talk about our SD access solution,
we're going to put all our controls down here instead.
That's right.
We're going to put all our controls right down here.
That way there we can make our network more efficient, more effective,
and implement security right down here, right at the get-go, right at the start,
and not have to worry about access controllers up here dealing with the traffic
that comes to it.
But more on that type of stuff later on.
But I want you to be able to pick these out of the lineup of the certification exams.
You already know a little bit about each of these for the exam as we mentioned them,
but think about the access layer as the point where end devices are attached to
the network.
So this is where we're going to attach our what?
We're going to attach our PCs.
Our cameras would be connected here.
Our printers would be connected here.
Our phones would be connected here.
Access points would be connected here.
This is the point of our network whereby we end up providing connectivity to it,
either physical connectivity using cables or wireless connectivity using
wireless access points.
And this is the most feature-rich area of your network.
It really is.
More than the distribution layer and more than the core.
You've got discovery and configuration services down here, CDP, LLDP as an example.
You've got security services like 802.1X.
You've got port security.
You've got DHCP snooping.
You've got dynamic ARP inspection.
You've got IP source guard.
You've got network identity and access services.
That's what I'm looking for.
Again, 802.1X.
You've got MAC authentication bypass.
You've got WebAuth that happens down here as well.
What else have we got?
We've got QS marking.
We've got policing.
We've got queuing.
We can do DPAC and inspection with NBAR.
We have spanning tree protocol, rapid spanning tree protocol.
We can even run.
That's right.
EIGRP, OSPF down here.
If we build our layer three network, that goes all the way down to here.
That's right.
We've got UDLD, FlexLinks, PortFast, UplinkFast, BackboneFast, LoopGuard, VPD, HoopGuard.
You don't need to know all of those for the exam.
But just to show you, there's so many services.
Oh, let's not forget about Power over Ethernet.
All of that at the access layer and a whole lot more.
Most feature-rich part of your network.
If you're ever asked on an exam, what is the most feature-rich part of your network?
It is your access layer.
It's not your core.
It's not your distribution layer.
It is your access layer.
That's the most feature-rich part of your network where end users connect.
Distribution layer is what?
It's an aggregation point.
It's a control point.
For the exam, if they were asked about the distribution layer, what does it do?
It's an aggregation point.
It's aggregating what?
Everybody at the access layer together.
When you think about everybody that's down here, they're coming up through one of two devices.
They're coming up through one of two devices.
We're aggregating that together.
That's why we typically put our policies here.
Why we typically put our security here.
Because we're able to do the most with the minimum amount of work.
Because this is where everybody has to go through.
This is where all the traffic flows.
It's where everything aggregates to.
So, policy enforcement here.
Typically, this is going to be what?
This is going to be our layer three environment.
It's going to be our layer two environment in this case.
Folks, when you hear the word layer three, what do you typically think of?
Chat in.
Yeah, routing.
Exactly.
So, we think of routing.
What else do we think of?
Well, with routing, we think of OSPF, or we think of EIGRP, or we think of something like maybe BGP, or we think of ISIS.
All different dynamic routing protocols.
Not going to use BGP there, but the other three are perfectly valid options.
Now, when you hear layer two, what do you typically think of?
We think of switching.
Yeah, absolutely.
So, switching.
And when we think of switching, what do we think of?
Yeah, VLANs.
What else?
VLANs.
Ooh, MAC addresses.
So, up here would be like IPs up there.
MAC addresses down here.
What else?
Trunks.
That's a good one.
What's a protocol that starts with an S?
That we find down here in layer two that we don't find in layer three?
Yeah, Spanning Tree Protocol.
So, what would you classify this then?
Typically, that is our demarcation point between our layer two technologies and services
and our layer three technology and services.
Just another thing to keep in mind for the certification exam.
Now, how many of you have your network designed like this,
where you've got your access, your distribution, and your core,
and you've got layer two and layer three like this?
If you do, type in yes.
If you don't, type in no.
Or if you don't answer, then I assume it's a no.
All right.
Yeah.
So, if you have a collapsed core.
So, let me ask you this, L. Washington.
With your collapsed core, are your access layer switches connected directly to the core?
Yeah.
Okay.
Perfect.
Yeah.
And why is that?
Smaller network.
And that's perfectly fine.
If you are not large enough to have all three of these layers,
because it doesn't make sense from a cost standpoint,
collapsed core is perfectly fine.
So, the next question I have here, L. Washington,
is the core device,
or let's put it this way,
is this where layer two begins going down to the access layer then?
Is that what you've done?
Or are you doing routing right down to here?
What is it?
First option.
So, layer two.
Right.
So, basically, this would be your default gateway for all your subnets, VLANs, broadcasts.
I mean, absolutely.
But what I'm trying to point here with this conversation, folks,
I'm not singling anyone out, right?
I'm just trying to show you, look, there's variability, right?
There's variability in what you can do.
Flexibility with this environment.
And that's what's so important.
So, yeah, many of us looks like this.
Some of us, the distribution layer might not even be there,
and it's layer two from the core right down to your access layer switches.
But then there are some of you out there who probably have this.
If you have this,
I want you to type in me.
Do you have this?
How many of you have this?
Where all of this is now routing,
and this is your layer two?
Totally valid option.
And we'll talk about this option
when we get to our discussion on SD access,
because that's how SD access works the best
when you do this type of architecture.
But again, just to show you that,
there are so many different ways
you can architect your environment using this approach.
But what are we going to learn first?
We're going to get to the fundamentals,
because the fundamentals matter the most,
and the fundamentals are what?
Layer three, layer two.
And so we're going to learn about all those technologies here
over our first few sessions,
because those still apply
no matter where you are moving this line
when it's all said and done.
And like we said, the core just connects everything together.
It's about high-speed connectivity,
high availability, highly redundant.
So it's critical to maintain what?
End-to-end connectivity.
Must always be on.
Has to move packets as fast as possible.
Provides scalability to the architecture.
These are all buzzwords,
keywords for the certification exam.
All right, so like we said,
there's the three-tier model.
There's that three-tier model, right?
But many of you have a collapsed core,
so maybe this is what you have instead.
So there's an example of a collapsed core.
So I assume L. Washington, that's what you have, right?
Yeah, right.
But some organizations might do it this way.
You see, look, that's also a collapsed core, right?
Not really collapsed core, but two-tier also.
All right, Spider-Man really loves this one
because Spider-Man can take a nap right here.
Yeah.
All right, but again, flexibility.
So pay attention on the exam.
If they do show you an architecture on the exam,
right, this, three-tier, right?
It's clear as bells.
Access, distribution, core.
You've got your three tiers.
You've got your two devices in the middle for the core, right?
And two, typically you're only gonna have two.
Any more than that is a waste of money, right?
Same thing with distribution layer.
Typically only two, typically only two,
typically only two, typically only two.
Again, know that for the exam in case it comes up.
And then access layer is pretty much whatever you need,
whatever you need to get the job done at the access layer.
All right, and then when you get to this model,
two in the middle for your collapsed core,
and then as whatever you need around the outside.
And again, layer two, layer three, doesn't matter, right?
This could be, for example, this could all be layer three for you.
This is L3, this is L2, this is L2, right?
Really depends on how you want to design it.
Or you could design it this way where it's all layer three.
And then you got your L2 down here, your L2.
So again, flexibility, folks.
So just pay attention to where they draw their lines
and so on and so forth.
So that way there you can answer questions on the exam.
It's not going to be difficult for this exam,
but as long as you know what I've just taught you.
So redundancy, as we can see, we've got a redundant distribution.
We got redundant core devices.
Something to pay attention to here, though,
is the fact that notice how these devices are not connected together.
Why is that?
Why are they not connected together in a traditional sense?
Now, for those of you who are doing stacking, okay, stacking,
we'll just forget about stacking right now.
Well, why would we not connect them together with Ethernet links?
Yeah, it would be routing loops.
You would not do that.
There's a protocol called Spanning Tree Protocol we're going to learn about.
Spanning Tree Protocol finds all loops in that environment,
and what does it do with all those loops?
It eliminates them by blocking ports.
So if you did all of this, what might happen in your environment
is you might end up blocking this, blocking this, blocking this,
blocking this, blocking this, blocking this to prevent loops.
So now everybody's traffic flows like this.
Everybody's traffic flows like this.
This is not good.
That's why we don't do it.
We don't do it like this because this could happen to us,
and these switches, like this switch is not designed
to handle the traffic from all those other switches.
It's an access layer switch.
It's designed for what?
North, south, traffic flow, in and out.
That's what it's designed for.
So you would not daisy chain them together as we talk about.
Now, stacking is a different thing, and we have a video in our enterprise,
not enterprise.
We have a video in our campus environment,
enterprise campus environment, I was going to say.
But down at the bottom under the architecture discussion,
I will talk about the concept of VSS and stack-wise
to help you get ready for the certification exam.
But what we're dealing with is we're dealing with a technology
that allows you to connect them together.
So you stack them together.
You don't have to physically stack them, all right,
but they got to be close enough together so you can connect a special cable.
It's called a stacking cable from here to here,
and then a stacking cable from here to here,
and then a stacking cable from here back to here.
And these are all your Ethernet cables.
So Ethernet cables are here, these are all your Ethernet cables,
and these are your stacking cables.
So what this does is it turns it from four single devices into one device.
That is one switch now.
When you stack switches together, they now become one entity,
one switch with a single management IP address,
allowing you to basically override a lot of the network
and a lot of the networking configuration blockages
that would come your way if you didn't do this.
So, for example, in our case,
Spanning Tree Protocol prevents me from doing a lot of things I want to do,
but if I stack, then I can trick Spanning Tree Protocol
into allowing me to do a lot of things that I wouldn't be allowed to do.
Okay?
So definitely, you know, don't connect them together with Ethernet,
but stacking is perfectly fine,
and we have a video on stacking for you to watch.
Yeah.
And also, you can have stack redundancy for power as well,
so they can all share power with each other.
So there's another set of stacking cables you can use as well.
Absolutely.
Yeah.
So John says,
I thought daisy chaining meant one switch downstream from another
but not connecting up to any other switches.
In reality, John,
the terminology is not going to make a difference for this certification exam.
So whether you thought, you know, daisy chaining meant this, right,
or daisy chaining your access layer switches together, right,
yeah, not with Ethernet cables, right,
don't worry too much about the word daisy chaining in that particular case.
All right?
So if it means something else to you,
then continue using daisy chain the way it means to you,
and whatever words you want to use here to describe what's going on down
here is perfectly fine, right?
So in this case,
don't connect these access layer switches together with Ethernet cables.
Perfect.
So now when it comes to multi-tier routed access virtual switch,
what does that mean?
We're just talking about our movements that we have in our particular case.
So, for example, we'll have layer two slash layer three.
This is what we call the multi-tier approach.
The multi-tier approach.
So what happens here is we've got VLANs terminated at the distribution layer.
So this is your VLAN, your subnet, your broadcast.
It means that your spanning tree protocol blocks 50% or more of your links in
this environment down here.
But you can have the same VLAN on multiple switches.
So I could have VLAN 10 here, VLAN 10 here.
Why?
Because we can communicate through the layer two network this way between
those devices in the VLAN.
It's cheaper than all the other options we're going to talk about here.
And then we have our first top redundancy protocols that we'll put up here as
we'll see later on.
So we're going to build this architecture as we go through this course.
When we get to our SD access discussion,
we're going to see this example here.
So SD access architecture, it's called.
Software defined access in the world of Cisco.
So down here, now you can see we removed routing all the way down here.
So your VLANs are actually terminated here.
They're terminated on those access layers.
Routing happens everywhere up here.
So there's no spanning tree protocol.
Now there's no first top redundancy protocols,
but it is more expensive because you would have to have multi-layer switches
here as opposed to layer two switches.
But now you are,
every user is directly connected to their what?
To their default gateway.
Because this would be the default gateway for the users that are
connected to it.
But that means that I can not have users directly connected to their
default gateway.
I can only have users directly connected to their default gateway.
But that means that I can not have users in different VLANs
span across this environment here.
For example, if I have VLAN 10 here,
I wouldn't be allowed to have VLAN 10 here because they are not
connected to each other.
Now if we were doing stacking, different story.
Again, stacking allows us to change some of the rules we have in place.
But without stacking,
I can't have somebody in VLAN 10 here and somebody in VLAN 10 here
anymore.
So as soon as you move that boundary, layer three.
Because of that, can't do that.
Now, could we implement something like VXLAN and get away with it?
Sure, of course we could.
But just with the fundamental technologies, no.
Without adding newer services, newer features,
more futuristic features and services,
we wouldn't be able to connect these two devices together that are in
VLAN 10 without using some tunneling technology to accomplish that.
Why?
Because we got a route.
Traffic is going to flow up here and come back down.
I need to tunnel through that layer three network to get from layer two
to layer two.
VXLAN allows me to do that.
More on that later.
Virtual switching.
So we have to realize we can have switches that are inside servers.
We can have switches that are inside servers.
So if we did not have switches inside our server, what would that mean?
It would mean that every single virtual machine on that server would have to
be in the same subnet slash VLAN slash broadcast domain as what?
As the port the server is connected to.
So let's say this was VLAN 10.
If I didn't have a virtual switch inside the server,
then every single virtual machine would have to be part of VLAN 10.
But by having virtual switches inside the servers and the hypervisors,
now I can trunk my link.
If you don't know what trunking is, we'll talk about it later today.
But trunking, and therefore now this virtual switch can be used to control
that.
Maybe that's VLAN 10, that's VLAN 20, that's VLAN 10.
And as a result of that now, I have the ability to control VLAN subnets,
broadcast domains from within that server as well.
So be mindful that even though the physical architecture may look like this,
you can extend that out into a virtual switch as well.
And it's important for the real world,
for you as a network enterprise admin to have control of that switch.
Now I know your virtual machine admins are probably like, no, no, no, no, no.
That's ours. It's in our, no, no, no, no, no.
That's a networking thing.
And it's very important that the networking professionals have control over
those virtual switches. Why?
Because those virtual switches are part of your architecture.
And more importantly,
they're part of your security architecture as a networking professional.
Therefore,
it's imperative that you have full control over those virtual switches.
And that's why Cisco has their own virtual switch.
So that way there you can have that virtual switch installed in that server
instead of using VMware's vSwitch. Okay.
You can use Cisco switch instead,
and it behaves just like your Cisco iOS products.
So that way there,
what you are doing can easily be extended into that virtual switch on your
device.
So it's going to allow you to manage your VLAN to VLAN communication using
your virtual switches inside of that actual server.
All right. So that is our architecture discussion, folks.
There's many good points in there that I encourage you to ensure you know,
in case they come up as a multiple choice question on the certification
exam.
Thank you.