Network Appliances: Switches, Routers, Firewalls and More

Scene 1 · 0:00

Lesson 2: Network appliances. Welcome to lesson two. Objective 1.2 asks you to compare networking appliances, applications and functions. In this lesson, we'll cover the appliances that move traffic, switches and routers, and the ones that protect and manage it: firewalls, intrusion detection and prevention systems, load balancers and proxies. Storage, wireless, and functions like VPN and quality of service come in the next lesson.

Scene 2 · 0:30

Switch: forwarding frames inside a network. We'll follow a small office network. The office computers plug into a switch. A switch works at Layer 2 and forwards frames using MAC addresses. It learns which device is on each port by reading source addresses, and builds a MAC address table. If it doesn't know a destination, or the frame is a broadcast, it floods it out of every port. Each port is its own collision domain, but all ports share one broadcast domain.

Scene 3 · 0:58

Router: moving packets between networks. To reach other networks, such as the internet, traffic goes through a router. A router works at Layer 3 and forwards packets using IP addresses. It looks up each destination in its routing table and picks the best path, often a default route toward the internet provider. Routers don't forward broadcasts, so each router interface separates broadcast domains. A multilayer switch combines both jobs: it switches frames and can also route between networks.

Scene 4 · 1:29

Firewall: allow or deny by rules. Between the office and the internet sits a firewall. A firewall permits or denies traffic based on rules, such as allowing web traffic out on port 443 and blocking everything else coming in. A stateless firewall checks each packet on its own. A stateful firewall tracks connections, so replies to traffic that started inside are allowed back automatically. Next-generation firewalls go further and recognize applications, at Layer 7.

Scene 5 · 1:59

IDS vs. IPS: detect, or detect and block. Firewalls follow rules, but some attacks look like normal traffic. That's where intrusion detection and prevention come in. An intrusion detection system, or IDS, watches a copy of the traffic, for example from a switch's mirror port, and alerts administrators when it spots something suspicious. An intrusion prevention system, or IPS, sits inline, so all traffic passes through it, and it can block the attack itself. The trade-off: a mistaken IPS can block legitimate traffic too.

Scene 6 · 2:33

How IDS and IPS spot attacks. How do they spot attacks? Signature-based detection compares traffic with patterns of known attacks, much like antivirus software. It's accurate for known threats, but it misses brand-new ones. Anomaly-based detection learns what normal traffic looks like and flags anything unusual, which can catch new attacks but produces more false positives. Policy-based detection flags traffic that breaks the rules your organization has defined.

Scene 7 · 3:03

Load balancer: sharing the work. Now the server side. The office runs its website on several web servers. A load balancer sits in front of them and spreads incoming requests across the group. It also runs health checks: if a server stops responding, the load balancer stops sending it traffic until it recovers. Users see one address and one website, while the work is shared, which improves both performance and availability.

Scene 8 · 3:30

Proxy: acting on someone's behalf. A proxy server makes requests on behalf of someone else. A forward proxy acts for clients: office computers send their web requests to the proxy, which can filter websites, cache popular content and hide internal addresses. A reverse proxy acts for servers: it receives requests from the internet and passes them to the servers behind it, often caching content or handling encryption. Many load balancers also work as reverse proxies.

Scene 9 · 4:02

Physical or virtual appliances. Every appliance in this lesson comes in two forms. A physical appliance is dedicated hardware, built for performance. A virtual appliance does the same job as software running on a virtual machine, such as a virtual router, firewall or load balancer. Virtual appliances can be deployed in minutes, copied and moved, and they run in data centers and in the cloud. You'll meet this idea again as network functions virtualization.

Scene 10 · 4:31

How the exam asks about this. On the exam, match the clue to the device. MAC addresses and frames point to a switch. IP addresses and paths between networks point to a router. Allow and deny rules mean a firewall. Detect and alert is an IDS; detect and block, inline, is an IPS. Spreading requests across servers is a load balancer. And making requests on behalf of clients or servers is a proxy.

Scene 11 · 5:00

Recap: network appliances. To recap: switches forward frames inside a network using MAC addresses, and routers forward packets between networks using IP addresses. Firewalls permit or deny traffic by rules. An IDS detects and alerts, while an inline IPS can also block. Load balancers share work across servers, and proxies act on behalf of clients or servers. Next, we'll finish objective 1.2 with storage, wireless and network functions.

Download captions (WebVTT)