WEBVTT
Kind: captions
Language: en

1
00:00:00.000 --> 00:00:05.875
Welcome to lesson two. Objective 1.2 asks you to compare networking appliances,

2
00:00:06.118 --> 00:00:11.842
applications and functions. In this lesson, we'll cover the appliances that move traffic,

3
00:00:11.935 --> 00:00:16.869
switches and routers, and the ones that protect and manage it: firewalls,

4
00:00:17.078 --> 00:00:22.140
intrusion detection and prevention systems, load balancers and proxies.

5
00:00:22.744 --> 00:00:29.303
Storage, wireless, and functions like VPN and quality of service come in the next lesson.

6
00:00:30.040 --> 00:00:34.614
We'll follow a small office network. The office computers plug into a switch.

7
00:00:35.218 --> 00:00:41.754
A switch works at Layer 2 and forwards frames using MAC addresses. It learns which device is on

8
00:00:41.824 --> 00:00:47.781
each port by reading source addresses, and builds a MAC address table. If it doesn't know a destination,

9
00:00:47.931 --> 00:00:54.479
or the frame is a broadcast, it floods it out of every port. Each port is its own collision domain,

10
00:00:54.630 --> 00:00:57.672
but all ports share one broadcast domain.

11
00:00:58.400 --> 00:01:02.463
To reach other networks, such as the internet, traffic goes through a router.

12
00:01:03.160 --> 00:01:09.813
A router works at Layer 3 and forwards packets using IP addresses. It looks up each destination

13
00:01:09.905 --> 00:01:15.328
in its routing table and picks the best path, often a default route toward the internet provider.

14
00:01:16.024 --> 00:01:21.086
Routers don't forward broadcasts, so each router interface separates broadcast domains.

15
00:01:21.783 --> 00:01:28.725
A multilayer switch combines both jobs: it switches frames and can also route between networks.

16
00:01:29.450 --> 00:01:35.806
Between the office and the internet sits a firewall. A firewall permits or denies traffic based

17
00:01:35.873 --> 00:01:42.162
on rules, such as allowing web traffic out on port 443 and blocking everything else coming in.

18
00:01:42.229 --> 00:01:48.317
A stateless firewall checks each packet on its own. A stateful firewall tracks connections,

19
00:01:48.384 --> 00:01:53.268
so replies to traffic that started inside are allowed back automatically.

20
00:01:53.335 --> 00:01:58.420
Next-generation firewalls go further and recognize applications, at Layer 7.

21
00:01:59.120 --> 00:02:05.146
Firewalls follow rules, but some attacks look like normal traffic. That's where intrusion detection

22
00:02:05.215 --> 00:02:11.903
and prevention come in. An intrusion detection system, or IDS, watches a copy of the traffic,

23
00:02:11.984 --> 00:02:17.638
for example from a switch's mirror port, and alerts administrators when it spots something suspicious.

24
00:02:18.335 --> 00:02:24.616
An intrusion prevention system, or IPS, sits inline, so all traffic passes through it,

25
00:02:24.941 --> 00:02:31.524
and it can block the attack itself. The trade-off: a mistaken IPS can block legitimate traffic

26
00:02:31.582 --> 00:02:32.650
too.

27
00:02:33.390 --> 00:02:39.532
How do they spot attacks? Signature-based detection compares traffic with patterns of known attacks,

28
00:02:39.810 --> 00:02:45.568
much like antivirus software. It's accurate for known threats, but it misses brand-new ones.

29
00:02:46.265 --> 00:02:51.699
Anomaly-based detection learns what normal traffic looks like and flags anything unusual,

30
00:02:51.942 --> 00:02:58.990
which can catch new attacks but produces more false positives. Policy-based detection flags traffic

31
00:02:59.036 --> 00:03:02.600
that breaks the rules your organization has defined.

32
00:03:03.350 --> 00:03:08.110
Now the server side. The office runs its website on several web servers.

33
00:03:08.551 --> 00:03:13.253
A load balancer sits in front of them and spreads incoming requests across the group.

34
00:03:13.764 --> 00:03:19.894
It also runs health checks: if a server stops responding, the load balancer stops sending it traffic

35
00:03:20.068 --> 00:03:25.955
until it recovers. Users see one address and one website, while the work is shared,

36
00:03:26.338 --> 00:03:29.635
which improves both performance and availability.

37
00:03:30.380 --> 00:03:36.591
A proxy server makes requests on behalf of someone else. A forward proxy acts for clients:

38
00:03:37.102 --> 00:03:41.758
office computers send their web requests to the proxy, which can filter websites,

39
00:03:41.967 --> 00:03:48.329
cache popular content and hide internal addresses. A reverse proxy acts for servers:

40
00:03:48.770 --> 00:03:52.915
it receives requests from the internet and passes them to the servers behind it,

41
00:03:53.298 --> 00:04:00.844
often caching content or handling encryption. Many load balancers also work as reverse proxies.

42
00:04:01.590 --> 00:04:07.534
Every appliance in this lesson comes in two forms. A physical appliance is dedicated hardware,

43
00:04:07.743 --> 00:04:13.374
built for performance. A virtual appliance does the same job as software running on a virtual

44
00:04:13.421 --> 00:04:20.561
machine, such as a virtual router, firewall or load balancer. Virtual appliances can be deployed

45
00:04:20.596 --> 00:04:25.634
in minutes, copied and moved, and they run in data centers and in the cloud.

46
00:04:26.145 --> 00:04:30.754
You'll meet this idea again as network functions virtualization.

47
00:04:31.490 --> 00:04:37.376
On the exam, match the clue to the device. MAC addresses and frames point to a switch.

48
00:04:37.968 --> 00:04:44.725
IP addresses and paths between networks point to a router. Allow and deny rules mean a firewall.

49
00:04:45.329 --> 00:04:53.734
Detect and alert is an IDS; detect and block, inline, is an IPS. Spreading requests across servers

50
00:04:53.781 --> 00:04:59.307
is a load balancer. And making requests on behalf of clients or servers is a proxy.

51
00:05:00.040 --> 00:05:04.788
To recap: switches forward frames inside a network using MAC addresses,

52
00:05:04.939 --> 00:05:11.743
and routers forward packets between networks using IP addresses. Firewalls permit or deny traffic

53
00:05:11.813 --> 00:05:18.012
by rules. An IDS detects and alerts, while an inline IPS can also block.

54
00:05:18.616 --> 00:05:24.479
Load balancers share work across servers, and proxies act on behalf of clients or servers.

55
00:05:25.176 --> 00:05:31.341
Next, we'll finish objective 1.2 with storage, wireless and network functions.