Network Config: Topologies, IP, Subnetting, Routing & Security

TAKEAWAYS:

• Network topologies (star, bus, ring, mesh) determine performance, cost, and scalability, with star being the most common in modern LANs.
• IP addressing (IPv4/IPv6) and subnetting (using CIDR notation) optimize address allocation and reduce waste.
• Routers use static/dynamic routing (RIP, OSPF) to forward packets between networks, while switches segment traffic at Layer 2.
• Firewalls, ACLs, and NAT are critical for securing networks and conserving public IP addresses.
• Cable types (UTP, STP, fiber) and Wi-Fi standards (802.11ac, 802.11ax) impact speed, distance, and interference.
• Real-world configurations (e.g., NTC’s ISP routing, Khalti’s load-balanced servers, Pathao’s GPS-based mesh networks) rely on these principles.

1. Network Topologies: How Devices Connect

Network topology defines how devices (computers, routers, switches) are physically or logically connected. The choice affects cost, scalability, fault tolerance, and performance.

Common Topologies

graph TD
    A["Bus Topology"] -->|"Single cable"| B["All devices share bandwidth"]
    C["Star Topology"] -->|"Central hub/switch"| D["Point-to-point links; failsafe if hub fails"]
    E["Ring Topology"] -->|"Closed loop"| F["Token-passing (e.g., old IBM Token Ring); slow if one node fails"]
    G["Mesh Topology"] -->|"Full/Partial connections"| H["High redundancy (e.g., military networks); expensive"]
    I["Hybrid Topology"] -->|"Combination"| J["E.g., Star-Bus (old Ethernet), Star-Mesh (data centers)"]

Key Comparisons:

Real-World Example:

• NTC’s ISP Network: Uses a hybrid topology—star for local exchanges (POPs) connected via mesh WAN links for redundancy. If one fiber route fails (e.g., Kathmandu–Pokhara), traffic reroutes automatically.
• Khalti’s Payment Gateway: Employs a star topology with load balancers at the center to distribute transactions across servers, ensuring no single point of failure.

2. IP Addressing and Subnetting: Dividing the Network

IP addresses uniquely identify devices on a network. IPv4 (32-bit) is still dominant, while IPv6 (128-bit) is growing due to address exhaustion.

IPv4 Basics

• Format: 192.168.1.1 (4 octets, 8 bits each).
• Classes (obsolete but useful for understanding):
  • Class A: 1.0.0.0–126.255.255.255 (e.g., 10.0.0.0/8 for private networks).
  • Class B: 128.0.0.0–191.255.255.255 (e.g., 172.16.0.0/12).
  • Class C: 192.0.0.0–223.255.255.255 (e.g., 192.168.1.0/24).
• Private Ranges (RFC 1918):
  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16

Worked Example: Subnetting a Class C Network Problem: Subnet 192.168.1.0/24 into 6 equal subnets. Solution:

1. Borrows 3 bits (since $2^3=8$ subnets > 6 needed).
2. New subnet mask: /27 (24 + 3).
3. Subnet IDs:
   • 192.168.1.0/27 (hosts: .1–.30)
   • 192.168.1.32/27 (hosts: .33–.62)
   • 192.168.1.64/27 (hosts: .65–.94)
   • ... (up to 192.168.1.192/27 for 6 subnets).

Why This Matters:

• Daraz’s Warehouse Network: Uses /24 subnets for each floor (e.g., 10.1.1.0/24 for Floor 1, 10.1.2.0/24 for Floor 2) to isolate traffic and simplify security policies.

3. Routing: How Packets Find Their Way

Routers connect networks and forward packets using routing tables. Two key methods:

A. Static Routing

• Manual configuration by an admin.
• Use Case: Small networks (e.g., home router with one default gateway).
• Example:

  Router(config)# ip route 0.0.0.0 0.0.0.0 203.123.45.1  // Default route to ISP
  Router(config)# ip route 192.168.2.0 255.255.255.0 192.168.1.2  // Route to Branch Office
  

B. Dynamic Routing (RIP, OSPF, BGP)

• Automatically updates based on network changes.
• RIP (Routing Information Protocol):
  • Distance-vector, max hop count = 15.
  • Example: Used in small ISPs like Ncell’s backhaul networks.
• OSPF (Open Shortest Path First):
  • Link-state, hierarchical (areas), faster convergence.
  • Example: NTC’s core routers use OSPF to route traffic between POPs.
• BGP (Border Gateway Protocol):
  • Path-vector, used for internet routing (e.g., Google’s global backbone).

Routing Table Example:

| 192.168.1.0 | 255.255.255.0 | 0.0.0.0 | Gig0/0 | | 10.0.0.0 | 255.0.0.0 | 192.168.1.2 | - |

Real-World Trace: Pathao’s GPS Data

1. Driver’s phone (192.168.1.100) sends GPS to Pathao’s app server (203.123.45.50).
2. Local router (192.168.1.1) forwards to ISP (203.123.45.1).
3. ISP’s border router uses BGP to route to Pathao’s cloud (13.37.0.0/16 in AWS).
4. Cloud load balancer distributes data to microservices.

4. Switches vs. Routers: Layer 2 vs. Layer 3

Worked Example: VLANs on a Switch

• Scenario: A college has 3 departments (CSIT, BBA, Law) sharing a switch.
• Solution: Create VLANs to separate traffic:

  Switch(config)# vlan 10    // CSIT
  Switch(config-vlan)# name CSIT
  Switch(config)# vlan 20    // BBA
  Switch(config-vlan)# name BBA
  Switch(config)# interface Gig0/1
  Switch(config-if)# switchport mode access
  Switch(config-if)# switchport access vlan 10
  

• Benefit: Prevents Law students from snooping on CSIT exams (broadcast isolation).

5. Network Security Basics

A. Firewalls

• Packet Filtering: Blocks based on IP/port (e.g., block 192.168.1.100:80).
• Stateful Inspection: Tracks connections (e.g., allow established HTTP).
• Example: Nepal Rastra Bank’s firewall blocks all inbound ports except 443 (HTTPS) and 22 (SSH).

B. Access Control Lists (ACLs)

• Standard ACL: Filters by source IP (e.g., allow 192.168.1.0/24).
• Extended ACL: Filters by IP + port (e.g., allow TCP 10.0.0.0/8 to 80,443).
• Example:

  Router(config)# access-list 100 permit tcp 10.0.0.0 0.255.255.255 host 203.123.45.50 eq 80
  Router(config)# interface Gig0/0
  Router(config-if)# ip access-group 100 in
  

C. Network Address Translation (NAT)

• Purpose: Conserves public IPs by mapping private IPs to one public IP.
• Types:
  • Static NAT: 192.168.1.100 → 203.123.45.10 (1:1).
  • Dynamic NAT: Pool of public IPs (e.g., 203.123.45.10-20).
  • PAT (Port NAT): Many private IPs → one public IP + port (e.g., 192.168.1.100:54321 → 203.123.45.1:80).
• Example: Home router uses PAT to let 5 devices share one public IP.

6. Cabling and Wireless Standards

A. Wired Media

B. Wireless (Wi-Fi)

Real-World Example:

• Pathao’s Driver App: Uses 802.11ac Wi-Fi for real-time GPS updates in offices and 4G/5G for drivers on the road. In Kathmandu’s crowded streets, mesh networking (devices relaying signals) improves coverage in dead zones.

7. Configuring a Router (Step-by-Step)

Scenario: Set up a router to connect two LANs (192.168.1.0/24 and 192.168.2.0/24) with internet access via 203.123.45.1.

Router Configuration Commands:

enable
configure terminal
! Configure LAN interfaces
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 no shutdown
! Configure WAN interface (DHCP from ISP)
interface GigabitEthernet0/2
 ip address dhcp
 no shutdown
! Set default route to ISP
ip route 0.0.0.0 0.0.0.0 203.123.45.1
! Enable NAT for internet access
ip nat inside source list 1 interface GigabitEthernet0/2 overload
access-list 1 permit 192.168.0.0 0.0.255.255
! Apply NAT to inside interface
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/2
 ip nat outside
end
write memory

In the Real World

1. NTC’s ISP Routing:

   • Uses OSPF for internal routing between POPs (e.g., Kathmandu, Pokhara, Biratnagar) and BGP to peer with global ISPs (e.g., AARNet, CERN).
   • Subnetting: Each POP has a /22 block (e.g., 10.10.0.0/22), further divided into /26 subnets for departments (billing, tech support, NOC).
   • Redundancy: Dual-homed connections to Ncell and SmartCell ensure no single link failure cuts off service.

2. Khalti’s Payment Gateway:

   • Load Balancers: Distribute transactions across servers using round-robin DNS (e.g., pay.khalti.com resolves to multiple IPs).
   • Firewall Rules: Only allow HTTPS (443) and ICMP (for monitoring) from trusted IPs.
   • NAT: Internal servers use 10.0.0.0/8; public-facing IPs are a small pool (e.g., 203.123.45.100-105).

3. Pathao’s Traffic Optimization:

   • Mesh Networking: Drivers in congested areas (e.g., Thapathali) relay GPS data via Wi-Fi Direct if cellular signal is weak.
   • VLANs: Separates driver app traffic (VLAN 10) from admin dashboards (VLAN 20) to prevent data leaks.
   • QoS: Prioritizes voice calls (for customer support) over GPS updates during peak hours.

Exam Tip

1. Diagrams Are Mandatory:

   • Always draw topology diagrams (star/bus/ring) and subnetting tables (show subnet IDs, broadcast addresses, usable hosts).
   • For routing questions, sketch a network with routers/switches and label IP addresses.

2. Common Pitfalls:

   • Subnetting Errors: Forgetting to calculate borrowed bits or broadcast addresses. Always verify with:
     • Subnet ID = Network + 0s in borrowed bits.
     • Broadcast = Subnet ID + 1s in host bits.
   • ACL Misplacement: Place standard ACLs close to the destination; extended ACLs close to the source.
   • NAT Confusion: Remember inside (private) vs. outside (public) interfaces.

3. Shortcut for Subnetting:

   • Use the subnet calculator formula:
     • Subnet mask: 256 - (256 / number of subnets).
     • Example: 6 subnets → 256 / 6 ≈ 43 → 256 - 43 = 212 → 212.212.212.0 (but this is for Class B; for Class C, use bit borrowing as shown earlier).

4. Real-World Scenarios:

   • Expect questions like:
     • "Design a network for a college with 5 departments, each needing 50 devices, and a server room. Use VLANs and justify your IP scheme."
     • "A router’s routing table shows a route to 10.0.0.0/8 via 192.168.1.2. What happens if the link to 192.168.1.2 fails?" (Answer: Uses default route or another route with lower metric.)

5. Practical Commands to Memorize:

   • show ip interface brief (check IP assignments).
   • show ip route (view routing table).
   • show arp (see MAC-IP mappings).
   • ping and traceroute (troubleshooting).