CCNP Enterprise ENCOR 350-401: IP Services, QoS & NAT (4/5)

Explore vpn over internet implementations for enterprise networks, comparing point-to-point and point-to-multipoint setups and encryption differences across jihadi encapsulation, dynamic multipoint vpn, and ipsec vpn.

Master generic routing encapsulation (GRE) to create a point-to-point tunnel between sites over the internet, enabling IPv6 over IPv4, multicast, and routing protocol traffic with simple, unencrypted configurations.

Explore the default lab setup for a vpn topology, building public-to-private ip tunnels and default routing across multiple sites to simulate enterprise connectivity.

Configure a point-to-point tunnel between two routers, set tunnel source and destination with /24 IPs, bring interfaces up, and enable a routing protocol for 192.168.1.0/24 and 192.168.2.0/24.

Configure multiple point-to-point tunnels to link routers from one to three and from one to four, create a central hub topology, then run HRB routing to ensure all LANs communicate.

Understand the major drawbacks of the classic GRE implementation, including its point-to-point nature requiring many manual tunnels for large networks and the lack of encryption by default.

Explore dmvpn, a multipoint vpn that connects many sites with a hub-and-spoke tunnel built dynamically via nhrp and next hop resolution protocol, and supports dynamic ip addresses on exit interfaces.

Explore dmvpn protocols that use multipoint gre for dynamic tunnels and nhrp for peer discovery. Configure routing for lan-to-lan communication and optionally ipsec to secure traffic.

Explore DMVPN with mGRE tunnels, detailing point-to-point and multipoint configurations, tunnel source and public IP requirements, and dynamic remote site discovery versus static public IP dependencies.

Explore how DMVPN uses NHRP protocols to map private to public IPs, register spokes with a hub, and establish tunnels through registration and resolution messages.

Demonstrate a vpn default lab setup with side-by-side routers, firewalls, and a simulated internet, using lan subnets and public ip addresses with default routing to ensure intersite connectivity.

Configure a basic DMVPN multipoint tunnel with a hub-and-spokes topology, using a single tunnel interface and dynamic spoke addresses, enabling NHRP and map commands to establish tunnels as traffic flows.

Configure EIGRP over a DMVPN multipoint tunnel to enable LAN-to-LAN routing, addressing multicast issues, and establishing neighbors with dynamic or specific mappings.

Explore how IPsec secures site-to-site and remote-access VPNs by authenticating and encrypting traffic, enabling protected communications between networks and gateways.

Learn how IPsec security services protect site-to-site connections through authentication, data integrity, confidentiality and encryption, anti-replay protection, and robust key management, including algorithm selection and key exchange.

Explore IPsec modes: tunnel versus transport, and how tunnel mode encapsulates traffic with a new IP for gateway-to-gateway encryption, while transport mode encrypts host-to-host data.

Identify traffic to protect, negotiate IPsec phase one and phase two, establish a secure channel, and encrypt data to secure the tunnel with timeout controls.

Configure interesting traffic between two endpoints to secure traffic for a vpn by using an extended access list, crypto maps, and phase two configurations.

Define and negotiate IKE phase-1 parameters to establish a secure channel, selecting authentication methods, encryption, and hashing algorithms, while aligning policy priorities and matching on both ends.

Explore IPsec phase 2, choosing ESP or AH to secure tunnels with encryption, authentication, and integrity. Define transform sets and crypto maps to apply the security policy to matching traffic.

Configure ipsec phase 2 by building a crypto map with phase two parameters and transform sets using esp encryption and isakmp authentication, then verify with show crypto commands and traffic.

Explore NAT concepts, including translating private IP addresses to public IP addresses and IPv4-era challenges. Examine Cisco configuration and learn NAT troubleshooting.

Understand why NAT translates private IPs to public addresses, addresses IPv4 exhaustion, and introduces IPv6 as a long-term solution, along with route summarization.

Explore how network address translation converts private IPs to public addresses, enabling many internal users to reach the internet while hiding private networks and conserving public IPs.

Explore static NAT, dynamic NAT, and NAT overload (port address translation) to map private to public IPs, manage IP pools, and enable many users to share a single public IP.

Configure a nat lab to translate private addresses to a public ip range. Validate static nat, border device translation, and routing through a simulated isp topology.

Explore a static nat lab that maps three private IPs to public addresses, configure inside and outside interfaces, verify translations, and practice clearing translation tables.

Discover dynamic NAT configuration by defining private and public IP ranges, mapping private addresses to a public pool, and applying inside/outside interface directions with ACL-based rules.

This lecture demonstrates a PAT lab that translates many private IPs to a single public IP using overload, with an ACL, a public IP pool, and translation table verification.

Translate private addresses to a single public IP using PAT via an exit interface, explaining static versus dynamic public IPs and verification of translations.

Learn first hop redundancy protocols that create a virtual gateway from two physical gateways to provide seamless internet access, with primary and secondary gateways handling automatic failover.

Explore the differences between HSRP, VRRP, and GLBP, including load balancing capabilities, primary and backup gateway roles, elections, timers, multicast communication, and virtual MAC concepts.

Configure and verify a basic HSRP lab with two gateways and a virtual gateway, establishing standby groups, default routes, static routing, and preemption options.

Configure HSRP advanced options to ensure fast convergence, including preempt and interface tracking with priority settings, and verify failover by simulating interface failures and observing primary and standby roles.

Configure HSRP load sharing by creating multiple groups with primary and backup gateways to balance traffic across two links. Set group priorities and property values to selectively route hosts and enable failover when a link fails, applicable to LAN and LTE gateway scenarios.

Configure VRRP on routers to establish master and backup roles using a virtual IP and track interfaces for failover, with default preemption and optional authentication.

Learn how GLBP enables load balancing across multiple gateways with a single virtual IP and multiple virtual MACs, using an active virtual gateway and forwarder.

Explore GLBP track and load balancing by using a track object tied to line protocol status to adjust gateway priority and enable weight-based or round-robin load sharing across multiple gateways.

Use IP SLA to measure delay, jitter, and connectivity, monitor end-to-end reachability, and automate failover between links with threshold-based actions across ISP, MPLS, and VPN networks.

Configure ip sla with icmp echo to test reachability and use track objects to failover to a backup route via static routes between dual isp links.

Explore how IP multicast sends a single data stream to a group of receivers, reducing bandwidth usage and server load compared with unicast and broadcast.

Multicast sends a single copy of information to a group of receivers identified by a multicast address, reducing server load and maintaining bandwidth utilization regardless of receiver count.

Learn how multicast works from a video server streaming to receivers, through multicast addresses and routing protocols such as protocol independent multicast, with layer 2 multicast switching.

Explore multicast IP ranges and how group addresses in 224 to 239 enable multicast applications. Learn about permanent multicast groups like 224.0.0.2 and one-hop delivery within local segments.

Explore igmp protocol and versions 1–3, detailing report and query messages, group-specific queries, leave messages, and source-specific multicast in version 3.

Explains protocol independent multicast (PIM) and how multicast routing selects between dense mode and sparse mode, using flood and prune versus rendezvous point to deliver multicast from sender to receivers.

Contrast PIM dense mode's flooding with PIM sparse mode's RP-based shared tree, then switch to a shortest-path tree for efficient multicast delivery.

Learn how to configure PIM dense mode, enabling IP multicast routing and per-interface flood and prune, simulate joins with IGMP join-group 224.0.0.13, and verify neighbors and multicast paths.

Explain how reverse path forwarding prevents multicast loops by validating the source against the best route and dropping non-matching interfaces, with fixes via enabling multicast or adjusting IGP costs.