Lesson 2 Part 1 - Configuring Standard Switch Policies
Video Activity
Lesson 2, Part 1 Configuring Standard Switch Policies This lesson discusses configuring standard switch policies and covers the following: Security Traffic Shaping NIC teaming capabilities With security policy, it is important to know about the following points: - Promiscuous mode MAC address changes Forged transmits Participants learn step by step...
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »
Difficulty
Intermediate
Video Description
Lesson 2, Part 1 Configuring Standard Switch Policies This lesson discusses configuring standard switch policies and covers the following:
-
Security
-
Traffic Shaping
-
NIC teaming capabilities
With security policy, it is important to know about the following points: - Promiscuous mode
-
MAC address changes
-
Forged transmits
Participants learn step by step instructions in a lab-based lesson on how to configure standard switch policies.
Video Transcription
00:04
Hello. My name is Dean Pompey. Leo. Welcome to Cyber ERY, where we'll be discussing the virtual ization installation configuration in management activities,
00:12
and we'll be working on module five. Lesson true
00:17
in this lesson will be configuring standard switch policies,
00:21
so we'll be covering things like the security options for your switch
00:25
traffic shaping
00:27
policies and Nick teaming capabilities.
00:33
So when we think about policies for our switch, we have to remember that these policies get to find at the switch level
00:40
or at the port in port Group level. You have some flexibility there.
00:44
This means you can define a policy for an entire switch
00:47
than anything that gets any of'em zika connected to that switch with Then inherit that policy.
00:52
However, you can handle switch with multiple pork groups and have different policies for each of those poor groups. It just depends on your requirements
01:00
and what kinds of traffic flows you're trying to control or harden with very security settings.
01:10
So starting off with our security policy
01:14
when you go to the properties of your of your virtual switch.
01:18
When you see that in your networking, there's the properties linked to the upper right of the switch.
01:23
We have a couple of settings right off the top that we need to discuss.
01:26
The first is promiscuous mode.
01:30
So promiscuous mode is putting an adapter.
01:33
Ah, virtual or physical into this. And the promiscuous mode means that that adapter Whoa,
01:38
process all the packets that it sees on that network segment.
01:42
This is useful if you're running an I. D. S
01:46
or ah, a sniffer
01:49
or some kind of protocol analyzer.
01:52
If you were interested in
01:55
keeping the security of your system as tight as possible, you might not want to allow promiscuous mode to happen.
02:04
Therefore, the the default setting is to reject promiscuous mode.
02:08
That means that packets
02:10
that are
02:13
that end up out on this virtual interface will actually get dropped instead of being processed.
02:17
You can change promiscuous mode to accept
02:20
in the event that you want to use something like an I. D. S or a snipper, or you might do that for troubleshooting purposes.
02:25
Ah, the next thing is Mac address changes. The default setting for this is except
02:31
this can be a little bit of a security risk as well.
02:35
For instance, you might be in an environment where the Mac addresses are expected to remain static and the and they're not expected to change.
02:43
For security reasons, that's a that's a good way to operate.
02:47
But, however, if I add a new virtual adapter to a switch, our or someone swaps out a physical dapper that's failed,
02:55
or you just add a new switch all together. Somewhere in the environment.
02:59
New Mac addresses will appear because now you've got new virtual hardware or new physical hardware,
03:05
and you need to be able to accommodate that.
03:08
So if you want to reject Mac address changes, then you need to
03:14
take responsibility for managing Mac address changes in the environment so that you can allow the ones that are new and unexpected.
03:22
Otherwise, you might be stuck in a situation where something's not communicating, and it's because yours, which was not allowing the Mac address change to be to be accepted.
03:31
So think about that for your security considerations.
03:36
The last item is forged transmits
03:39
the default setting, for this is except which might seem a little bit strange.
03:44
Uh, and that means that anyone who was spoofing an I P address,
03:49
for instance, would be able to get their traffic through
03:52
for security reasons. You might wantto set this back to reject
03:57
instead so that you can keep a tighter control over which systems are allowed to communicate on your network and your virtual network.
04:06
So once you set your security policy again, the whole switch inherits it, or it's inherited at the port or even the port group level.
04:15
Then we have to think about how we want to shape the traffic.
04:19
Traveling, shaping is disabled by default. This is something you have to enable if you want to use it.
04:27
And the idea with traffic traffic shaping is that you can prioritize certain traffic over others.
04:32
For instance, you might
04:33
have a traffic shaping policy for your I P storage network
04:38
to allow the greatest use of banned with within some range.
04:43
And then maybe you might want to restrict the band with usage by other types of traffic, like
04:48
video streaming traffic that's on your regular user network
04:53
or possibly your management network might require only a little bit of band with so you can restrict its usage free up bandwith for other users in the environment.
05:03
So remember again, this is disabled.
05:05
If you do enable it within the properties of the switch. You'll you'll see this when we look at the lab in just a little bit.
05:13
We have three different settings to consider.
05:15
These are all in killing bits per second.
05:18
So the average man with is just what it sounds like. You can limit the average band with through that device
05:25
on a kill a bit per second basis,
05:28
and that might be important thing to do. For instance, if you had a ah gigabit network
05:34
and you had 10 different switches that were utilizing van with, if you wanted to
05:40
divide them up evenly, you could say, Well, no switch should be able to use more than 100 megabits each.
05:46
That means that even if all switches were running at maximum capacity, you would still be able to satisfy all of those requirements without
05:55
affecting the performance of the of any of one switch over another.
05:58
So that's one sighting we can consider.
06:00
There's also a peaked in with
06:01
starting.
06:02
This means that for some short period of time,
06:05
you can allow the band with utilization for that switch to exceed with the average band with setting my Pete.
06:14
So if I had a setting of 100 megabits, for instance, for a switch, I could say a peak of 150
06:19
and that's expected to only last for a short period of time,
06:24
with the assumption that the other switches would not all be fully utilized or you're using their peak band with at the same moment as this one. Particular switch requires it,
06:33
so that gives you some ability to kind of find tune. The band, with your relation will further,
06:40
and then our last item is the burst size.
06:44
So birth sizes, even a shorter duration event
06:46
where perhaps you're you're downloading a large file,
06:50
and your peak plan with an average band with is not big enough so you can allow for a burst settings, Let's say 200 megabits per second,
07:00
two for a short period of time to allow certain events to happen without having too much performance impact on the other
07:09
switches in this or the other switches in the environment
07:13
on as you do, you make changes to these settings. You might want to do some
07:19
ah little bit of trial and error and some experiments to see what settings work best. for your particular environment.
07:26
For the purposes of the labs, however, we're going to leave these settings at their default, which is basically disabled.
07:33
Okay, so moving on to Nick teeming
07:36
will be Team Nick's.
07:39
This is a way of grouping
07:43
interfaces together so that we can take advantage of various functionality. There's only applies to physical interfaces. If I do teeming with virtual interfaces, that doesn't really buy me anything,
07:56
as I could have,
07:57
UH, four Virtual Nick's all going through this to physical. Nix
08:03
threw the switch right. I have to uplink ports to physical necks,
08:07
but if I team some of my virtual nix together, I don't get any more bandwidth, and I would get from the physical mix that are already available to me.
08:15
So that's an important concept to think about. The teeming really only applies to your physical next,
08:22
so the load balancing and nick teeming environment is outbound on Lee for standard switches.
08:28
If you have a distributed switch
08:31
which allows it hosts to be connected together through a switch,
08:35
then you can use inbound and outbound
08:37
load balancing methods. Since we're only using standard
08:41
virtual switches for these labs outbound on Lee would apply.
08:46
The first thing to consider in this case is network failure detection.
08:50
So what happens when
08:54
when I've got a problem with my network, someone pulls a cable, Ah, network interface card dies
08:58
new,
09:01
you know, switch fails. And now I've lost some connection.
09:05
I have two options. For for this case, I can monitor link state,
09:11
which is the most basic method of detecting a failure.
09:15
So if I If you plug a network cable in you, you get a link light that shows you've got a connection. If that cable comes out, the link state is now down
09:22
and you never fail. You detection can work with that.
09:26
However,
09:26
link state monitoring link. State only monitoring is rather limited. It can't detect any failures upstream from the device that had the failure.
09:37
If you use link state plus weakening
09:39
now the virtual switch will send out a packet every second
09:43
to determine whether other switches that are connected to this virtual switch within that network are alive and well.
09:50
So this gives ah more accurate detection of changes in the network topology.
09:58
Mmm.
09:58
That a very small expense of a tiny bit of overhead for sending out that packet every second. It's only 62 bites, I believe so. It's very small amount.
10:09
So in most cases you would want to use links Day plus, beginning to get a better representation of failures in your network.
10:16
The next option to think about for Nick Teeny has notify. Switch is just what it sounds like
10:22
if there's a change in the network topology. If I lose a connection to my neighboring switch or to a neighboring
10:28
selection of switches,
10:31
I want to be able to detect that, of course, using one of these two methods.
10:37
So this detects failures or new connections.
10:41
And when a new connection happens in your in your network topology, or if a failure happens,
10:46
all of the switches need to notify each other
10:50
in order to remap that networked apology to show what the new available physical paths are.
10:56
So if I lose a connection, I want to be able to notify switches in my general area that I'm connected to. Hey, this link is down.
11:07
Reorganize your mapping tables to take advantage of the existing links,
11:11
and various vendors do this in different ways. Cisco devices do it slightly different than a D link fight device would do, and so on
Up Next
Lesson 2 Part 2 - Configuring Standard Switch Policies (continued)
Lesson 1 Part 1 - Storage
Lesson 1 Part 2 - Data stores (continued)
Lesson 2 - Working with Configuring iSCSI
Lesson 3 - Working with NFS Storage
Similar Content
