For connecting internet, we require various internetworking devices. Some of the common devices used in building up Internet are.
NIC: Network Interface Card or NIC are printed circuit boards that are installed in workstations. It represents the physical connection between the workstation and network cable. Although NIC operates at the physical layer of the OSI model, it is also considered as a data link layer device. Part of the NIC’s is to facilitate information between the workstation and the network. It also controls the transmission of data onto the wire
Hubs: A hub helps to extend the length of a network cabling system by amplifying the signal and then re-transmitting it. They are basically multiport repeaters and not concerned about the data at all. The hub connects workstations and sends a transmission to all the connected workstations.
Bridges: As network grow larger, they often get difficult to handle. To manage these growing network, they are often divided into smaller LANs. These smaller LANS are connected to each other through bridges. This helps not only to reduce traffic drain on the network but also monitors packets as they move between segments. It keeps the track of the MAC address that is associated with various ports.
Switches: Switches are used in the option to bridges. It is becoming the more common way to connect network as they are simply faster and more intelligent than bridges. It is capable of transmitting information to specific workstations. Switches enable each workstation to transmit information over the network independent of the other workstations. It is like a modern phone line, where several private conversation takes place at one time.
Routers: The aim of using a router is to direct data along the most efficient and economical route to the destination device. They operate at Network layer 3, which means they communicate through IP address and not physical (MAC) address. Routers connect two or more different networks together, such as an Internet Protocol network. Routers can link different network types such as Ethernet, FDDI, and Token Ring.
Brouters: It is a combination of both routers and bridge. Brouter act as a filter that enables some data into the local network and redirects unknown data to the other network.
Modems: It is a device that converts the computer-generated digital signals of a computer into analog signals, traveling via phone lines.
Understanding TCP/ IP layers
TCP/IP stands for Transmission Control Protocol/ Internet Protocol. It determines how a computer should be connected to the Internet and how data should be transmitted between them.
TCP: It is responsible for breaking data down into small packets before they can be sent on the network. Also, for assembling the packets again when they arrive.
IP (Internet Protocol): It is responsible for addressing, sending and receiving the data packets over the internet.
To understand TCP/IP internet layer we take a simple example. When we type something in an address bar, our request will be processed to the server. The server will respond back to us with the request. This communication on the internet is possible due to the TCP/IP protocol. The messages are sent and received in small packages.
The Internet layer in the TCP/IP reference model is responsible for transferring data between the source and destination computers. This layer includes two activities
Transmitting data to the Network Interface layers
Routing the data to the correct destinations
So how this happen?
Internet layer packs data into data packets referred as IP datagrams. It consists of source and destination IP address. Beside this, IP datagram header field consists of information like version, header length, type of service, datagram length, time to live, and so on.
In network layer, you can observe network protocols like ARP, IP, ICMP, IGMP, etc. The datagram are transported through network using these protocols. They each resemble some function like.
The Internet Protocol (IP) is responsible for IP addressing, routing, the fragmentation and reassembly of packets. It determines how to route message on the network.
Likewise, you will have ICMP protocol. It is responsible for diagnostic functions and reporting errors due to the unsuccessful delivery of IP packets.
For the management of IP multicast groups, IGMP protocol is responsible.
The ARP or Address Resolution Protocol is responsible for the resolution of the Internet layer address to the Network Interface layer address such as a hardware address.
RARP is used for disk less computers to determine their IP address using the network.
The image below shows the format of an IP address.
Understanding TCP/IP Transport Layer
The transport layer also referred as Host-to-Host Transport layer. It is responsible for providing the Application layer with session and datagram communication services.
The main protocols of the Transport layer are User Datagram Protocol (UDP) and the Transmission Control Protocol (TCP).
TCP is responsible for the sequencing, and acknowledgment of a packet sent. It also does the recovery of packet lost during transmission. Packet delivery through TCP is more safe and guaranteed. Other protocols that falls in the same category are FTP, HTTP, SMTP, POP, IMAP, etc.
UDP is used when the amount of data to be transferred is small. It does not guarantee packet delivery. UDP is used in VoIP, Videoconferencing, Pings, etc.
Network segmentation implicates splitting the network into smaller networks. It helps to split the traffic loads and improve the speed of the Internet.
By implementing DMZ (demilitarised zones) and gateways between networks or system with different security requirements.
By implementing server and domain isolation using Internet Protocol Security (IPsec).
By implementing storage based segmentation and filtering using techniques like LUN (Logical Unit Number) masking and Encryption.
By implementing DSD evaluated cross-domain solutions where necessary
Why Network Segmentation is important
Network Segmentation is important for following reasons,
Improve Security– To protect against malicious cyber attacks that can compromise your network usability. To detect and respond to an unknown intrusion in the network
Isolate network problem– Provide a quick way to isolate a compromised device from the rest of your network in case of intrusion.
Reduce Congestion– By segmenting the LAN, the number of hosts per network can be reduced
Extended Network– Routers can be added to extend the network, allowing additional hosts onto the LAN.
VLANs enables an administrator to segment networks. Segmentation is done based on the factors such as project team, function or application, irrespective of the physical location of the user or device. A group of devices connected in a VLAN act as if they are on their own independent network, even if they share a common infrastructure with other VLANs. VLAN is used for data-link or internet layer while subnet is used for Network/IP layer. Devices within a VLAN can talk to each other without a Layer-3 switch or router.
The popular device used for segmenting are a switch, router, bridge, etc.
Subnets are more concerned about IP addresses. Subnetting is primarily a hardware-based, unlike VLAN, which is software based. A subnet is a group of IP address. It can reach any address without using any routing device if they belong to the same subnet.
In this CCNA tutorial, we will learn few things to consider while doing network segmentation
Proper user authentication to access the secure network segment
ACL or Access lists should be properly configured
Access audit logs
Anything that compromises the secure network segment should be checked- packets, devices, users, application, and protocols
Keep watch on incoming and outgoing traffic
Security policies based on user identity or application to ascertain who has access to what data, and not based on ports, IP addresses, and protocols
Do not allow the exit of cardholder data to another network segment outside of PCI DSS scope.
Packet Delivery Process
So far we have seen different protocols, segmentation, various communication layers, etc. Now we are going to see how the packet is delivered across the network. The process of delivering data from one host to another depends on whether or not the sending and receiving hosts are in the same domain.
A packet can be delivered in two ways,
A packet destined for a remote system on a different network
A packet destined for a system on the same local network
If the receiving and sending devices are connected to the same broadcast domain, data can be exchanged using a switch and MAC addresses. But if the sending and receiving devices are connected to a different broadcast domain, then the use of IP addresses and the router is required.
Layer 2 packet delivery
Delivering an IP packet within a single LAN segment is simple. Suppose host A wants to send a packet to host B. It first needs to have an IP address to MAC address mapping for host B. Since at layer 2 packets are sent with MAC address as the source and destination addresses. If a mapping does not exist, host A will send an ARP Request (broadcast on the LAN segment) for the MAC address for IP address. Host B will receive the request and respond with an ARP reply indicating the MAC address.
Intrasegment packet routing
If a packet is destined for a system on the same local network, which means if the destination node are on the same network segment of the sending node. The sending node addresses the packet in the following way.
The node number of the destination node is placed in the MAC header destination address field.
The node number of the sending node is placed in the MAC header source address field
The full IPX address of the destination node is placed in the IPX header destination address fields.
The full IPX address of the sending node is placed in the IPX header destination address fields.
Layer 3 Packet delivery
To deliver an IP packet across a routed network, it requires several steps.
For instance, if host A wants to send a packet to host B it will send the packet in this ways