Networking

Network Access Control (NAC) is a method of ensuring that only known devices are allowed to connect to your network and that they meet your network’s requirements before they are granted access.

This is NAC at its most basic level. However, today’s NAC is usually also capable of dictating each user’s level of access and of managing users’ access once they’re on the network.

NAC has a special place in a network security plan because, unlike a firewall, which offers perimeter protection, it monitors the inside of your network. A firewall stops the hacker in Poland from getting to your network through the Internet. NAC stops the hacker inside your building or in the parking lot from getting to your network through an Ethernet port or a wireless access point.

Even though a NAC appliance may also monitor network activity, enforce policies, control resources, and document security, the core function of NAC is to authenticate trusted devices and control who can access your network. It’s important to keep in mind that NAC is only part of a security plan, not a complete security measure. It doesn’t take the place of a firewall and won’t protect against data leaving through e-mail, printouts, or USB flash drives.

SNMP (Simple Network Management Protocol) management is the standard for LAN management, particularly in mission-critical applications. The standard is controlled by the Internet Engineering Task Force (IETF). It was designed to manage network configuration, performance, faults, accounting, and security.

An SNMP agent must be present at the device level (a router or a hub, for example), either built into the unit or as a proxy agent, and is accessed through a remote terminal. SNMP does not follow a polling protocol. It waits to receive data from the remote device or sends data based on operator commands.

By using one common set of standards, SNMP enables network administrators to manage, monitor, and control their SNMP-compliant network equipment with one management system and from one management station. If a network device goes down, it|s possible to both pinpoint and troubleshoot the problem more efficiently. And a network administrator isn’t limited to equipment from just one vendor when using an SNMP program.

The Open Systems Interconnection (OSI) Reference Model provides a layered network design framework that establishes a standard so that devices from different vendors work together.

Layer 2 (The Data-Link Layer)
Layer 2 switches operate using physical network addresses. Physical addresses, also known as link-layer, hardware, or MAC-layer addresses, identify individual devices. Most hardware devices are permanently assigned this number during the manufacturing process.

Switches operating at Layer 2 are very fast because they’re just sorting physical addresses, but they usually aren’t very smart.

Layer 3 (The Network Layer)
Layer 3 switches use network or IP addresses that identify locations on the network. Physical addresses identify devices; network addresses identify locations. A location can be a LAN workstation, a location in a computer’s memory, or even a packet of data traveling through a network.

Network addresses are hierarchical. The more details included, the more specific the address becomes and the easier it is to find.

Switches operating at Layer 3 are smarter than Layer 2 devices and incorporate routing functions to actively calculate the best way to send a packet to its destination. However, because Layer 3 Switches take the extra time to read more details of a network address, they are sometimes much slower than Layer 2 Switches.

Layer 4 (The Transport Layer)
Layer 4 of the OSI Model coordinates communications between systems. Layer 4 identifies which application protocols (HTTP, SNTP, FTP, etc.) are included with each packet and uses this information to hand off the packet to the appropriate higher-layer software. Layer 4 switches make packet forwarding decisions based not only on the MAC address and IP address, but also on the application a packet belongs to.

Because Layer 4 devices enable you to establish priorities for network traffic based on application, you can assign a high priority to packets belonging to vital in-house applications, such as Peoplesoft®, with different forwarding rules for low-priority packets, such as generic HTTP-based Internet traffic.

Layer 4 switches also provide an effective wire-speed security shield for your network.

Fiber optic cable not only gives you immunity to interference and greater signal security, but it’s also constructed to insulate the fiber’s core from the stress associated with use in harsh environments.

The core is a very delicate channel that’s used to transport data signals from an optical transmitter to an optical receiver. To help reinforce the core, absorb shock, and provide extra protection against cable bends, fiber cable contains a coating of acrylate plastic.

In an environment free from the stress of external forces such as temperature, bends, and splices, fiber optic cable can transmit light pulses with minimal attenuation. And although there will always be some attenuation from external forces and other conditions, there are two methods of cable construction to help isolate the core: loose-tube and tight-buffer construction.

In a loose-tube construction, the fiber core literally floats within a plastic gel-filled sleeve. Surrounded by this protective layer, the core is insulated from temperature extremes, as well as from damaging external forces such as cutting and crushing.

In a tight-core construction, the plastic extrusion method is used to apply a protective coating directly over the fiber coating. This helps the cable withstand even greater crushing forces. But while the tight-buffer design offers greater protection from core breakage, it’s more susceptible to stress from temperature variations. Conversely, while it’s more flexible than loose-tube cable, the tight-buffer design offers less protection from sharp bends or twists.

Fiber versus copper.

When planning a new or upgraded cabling infrastructure, you have two basic choices: fiber or copper. Both offer superior data transmission. The decision on which one to use may be difficult. It will often depend on your current network, your future networking needs, and your particular application, including bandwidth, distances, environment, cost, and more. In some cases, copper may be a better choice; in other situations, fiber offers advantages.

Although copper cable is currently more popular and much more predominant in structured cabling systems and networks, fiber is quickly gaining fans.

Fiber optic cable is becoming one of the fastest-growing transmission mediums for both new cabling installations and upgrades, including backbone, horizontal, and even desktop applications. Fiber optic cable is favored for applications that need high bandwidth, long distances, and complete immunity to electrical interference. It’s ideal for high data-rate systems such as Gigabit Ethernet, FDDI, multimedia, ATM, SONET, Fibre Channel, or any other network that requires the transfer of large, bandwidth-consuming data files, particularly over long distances. A common application for fiber optic cable is as a network backbone, where huge amounts of data are transmitted. To help you decide if fiber is right for your new network or if you want to migrate to fiber, take a look at the following:

The advantages of fiber.

Greater bandwidth-Because fiber provides far greater bandwidth than copper and has proven performance at rates up to 10 Gbps, it gives network designers future-proofing capabilities as network speeds and requirements increase. Also, fiber optic cable can carry more information with greater fidelity than copper wire. That’s why the telephone networks use fiber, and many CATV companies are converting to fiber.

Low attenuation and greater distance-Because the fiber optic signal is made of light, very little signal loss occurs during transmission so data can move at higher speeds and greater distances. Fiber does not have the 100-meter (304.8-ft.) distance limitation of unshielded twisted-pair copper (without a booster). Fiber distances can range from 300 meters to 40 kilometers, depending on the style of cable, wavelength, and network. (Fiber distances are typically measured in metric units.) Because fiber signals need less boosting than copper ones do, the cable performs better.

Fiber networks also enable you to put all your electronics and hardware in one central location, instead of having wiring closets with equipment throughout the building.

Security-Your data is safe with fiber cable. It does not radiate signals and is extremely difficult to tap. If the cable is tapped, it’s very easy to monitor because the cable leaks light, causing the entire system to fail. If an attempt is made to break the security of your fiber system, you’ll know it.

Immunity and reliability-Fiber provides extremely reliable data transmission. It’s completely immune to many environmental factors that affect copper cable. The fiber is made of glass, which is an insulator, so no electric current can flow through. It is immune to electromagnetic interference and radio-frequency interference (EMI/RFI), crosstalk, impedance problems, and more. You can run fiber cable next to industrial equipment without worry. Fiber is also less susceptible to temperature fluctuations than copper is and can be submerged in water.

Design-Fiber is lightweight, thin, and more durable than copper cable. And, contrary to what you might think, fiber optic cable has pulling specifications that are up to ten times greater than copper cable’s. Its small size makes it easier to handle, and it takes up much less space in cabling ducts. Although fiber is still more difficult to terminate than copper is, advancements in connectors are making temination easier. In addition, fiber is actually easier to test than copper cable.

Migration-The proliferation and lower costs of media converters are making copper to fiber migration much easier. The converters provide seamless links and enable the use of existing hardware. Fiber can be incorporated into networks in planned upgrades.

Standards-New TIA/EIA standards are bringing fiber closer to the desktop. TIA/EIA-785, ratified in 2001, provides a cost-effective migration path from 10-Mbps Ethernet to 100-Mbps Fast Ethernet over fiber (100BASE-SX). A recent addendum to the standard eliminates limitations in transceiver designs. In addition, in June 2002, the IEEE approved a 10-Gigabit Ethernet standard.

Costs-The cost for fiber cable, components, and hardware is steadily decreasing. Installation costs for fiber are higher than copper because of the skill needed for terminations. Overall, fiber is more expensive than copper in the short run, but it may actually be less expensive in the long run. Fiber typically costs less to maintain, has much less downtime, and requires less networking hardware. And fiber eliminates the need to recable for higher network performance.

Multimode or single-mode, duplex or simplex?

Multimode-Multimode fiber optic cable can be used for most general fiber applications. Use multimode fiber for bringing fiber to the desktop, for adding segments to your existing network, or in smaller applications such as alarm systems. Multimode cable comes with two different core sizes: 50 micron or 62.5 micron.

Single-mode-Single-mode is used over distances longer than a few miles. Telcos use it for connections between switching offices. Single-mode cable features an 8.5-micron glass core.

Duplex-Use duplex multimode or single-mode fiber optic cable for applications that require simultaneous, bidirectional data transfer. Workstations, fiber switches and servers, fiber modems, and similar hardware require duplex cable. Duplex is available in single- and multimode.

Simplex-Because simplex fiber optic cable consists of only one fiber link, you should use it for applications that only require one-way data transfer. For instance, an interstate trucking scale that sends the weight of the truck to a monitoring station or an oil line monitor that sends data about oil flow to a central location. Simplex fiber comes in single- and multimode types.

50- vs. 62.5-micron cable.

Although 50-micron fiber cable features a smaller core, which is the light-carrying portion of the fiber, both 62.5- and 50-micron cable feature the same glass cladding diameter of 125 microns. You can use both in the same types of networks, although 50-micron cable is recommended for premise applications: backbone, horizontal, and intrabuilding connections, and should be considered especially for any new construction and installations. And both can use either LED or laser light sources.

The big difference between 50-micron and 62.5-micron cable is in bandwidth-50-micron cable features three times the bandwidth of standard 62.5-micron cable, particularly at 850 nm. The 850-nm wavelength is becoming more important as lasers are being used more frequently as a light source.

Other differences are distance and speed. 50-micron cable provides longer link lengths and/or higher speeds in the 850-nm wavelength. See the table below.

The ferrules: ceramic or composite?

As a general rule, use ceramic ferrules for critical network connections such as backbone cables or for connections that will be changed frequently, like those in wiring closets. Ceramic ferrules are more precisely molded and fit closer to the fiber, which gives the fiber optic cables a lower optical loss.

Use composite ferrules for connections that are less critical to the network’s overall operation and less frequently changed. Like their ceramic counterparts, composite ferrules are characterized by low loss, good quality, and a long life. However, they are not as precisely molded and slightly easier to damage, so they aren’t as well-suited for critical connections.

Testing and certifying fiber optic cable.

If you’re accustomed to certifying copper cable, you’ll be pleasantly surprised at how easy it is to certify fiber optic cable because it’s immune to electrical interference. You only need to check a few measurements.

Attenuation (or decibel loss)-Measured in decibels/kilometer (dB/km), this is the decrease of signal strength as it travels through the fiber cable. Generally, attenuation problems are more common on multimode fiber optic cables.

Return loss-This is the amount of light reflected from the far end of the cable back to the source. The lower the number, the better. For example, a reading of -60 decibels is better than -20 decibels. Like attenuation, return loss is usually greater with multimode cable.

Graded refractive index-This measures how the light is sent down the fiber. This is commonly measured at wavelengths of 850 and 1300 nanometers. Compared to other operating frequencies, these two ranges yield the lowest intrinsic power loss. (NOTE: This is valid for multimode fiber only.)

Propagation delay-This is the time it takes a signal to travel from one point to another over a transmission channel.

Optical time-domain reflectometry (OTDR)-This enables you to isolate cable faults by transmitting high-frequency pulses onto a cable and examining their reflections along the cable. With OTDR, you can also determine the length of a fiber optic cable because the OTDR value includes the distance the optic signal travels.

There are many fiber optic testers on the market today. Basic fiber optic testers function by shining a light down one end of the cable. At the other end, there’s a receiver calibrated to the strength of the light source. With this test, you can measure how much light is going to the other end of the cable. Generally, these testers give you the results in dB lost, which you then compare to the loss budget. If the measured loss is less than the number calculated by your loss budget, your installation is good.

Newer fiber optic testers have a broad range of capabilities. They can test both 850- and 1300-nanometer signals at the same time and can even check your cable for compliance with specific standards.

Fiber precautions.

A few properties particular to fiber optic cable can cause problems if you aren’t careful during installation.

Intrinsic power loss-As the optic signal travels through the fiber core, the signal inevitably loses some speed through absorption, reflection, and scattering. This problem is easy to manage by making sure your splices are good and your connections are clean.

Microbending-Microbends are minute deviations in fiber caused by excessive bends, pinches, and kinks. Using cable with reinforcing fibers and other special manufacturing techniques minimizes this problem.

Connector loss-Connector loss occurs when two fiber segments are misaligned. This problem is commonly caused by poor splicing. Scratches and dirt introduced during the splicing process can also cause connector loss.

Coupling loss-Similar to connector loss, coupling loss results in reduced signal power and is from poorly terminated connector couplings.

Remember to be careful and use common sense when installing fiber cable. Use clean components. Keep dirt and dust to a minimum. Don’t pull the cable excessively or bend it too sharply around any corners. That way, your fiber optic installation can serve you well for many years.

OSI Layer Physical Component

7-Application

Applicaton Software

LAN-Compatible Software E-Mail, Diagnostics, Word Processing, Database

Network Applications

6-Presentation

Data- Conversion Utilities

Vendor-Specific Network Shells and Gateway™ Workstation Software

5-Session

Network Operating System

SPX

NetBIOS

DECnet™

TCP/IP

AppleTalk®

4-Transport

Novell® NetWare® IPX™

PC LAN

LAN Mgr

DECnet

PC/TCP®

VINES™

NFS

TOPS®

Apple Share®

3-Network Control

2-Data Link

Network

E

A

TR

P

TR

E

TR

E

E

E

P

E

P

1-Physical

E=Ethernet; TR=Token Ring; A=ARCNET®; P=PhoneNET®

With the rapid development of computer networks over the last decade, high-end switching has become one of the most important functions on a network for moving data efficiently and quickly from one place to another.

Here’s how a switch works: As data passes through the switch, it examines addressing information attached to each data packet. From this information, the switch determines the packet’s destination on the network. It then creates a virtual link to the destination and sends the packet there.

The efficiency and speed of a switch depends on its algorithms, its switching fabric, and its processor. Its complexity is determined by the layer at which the switch operates in the OSI (Open Systems Interconnection) Reference Model (see above).

OSI is a layered network design framework that establishes a standard so that devices from different vendors work together. Network addresses are based on this OSI Model and are hierarchical. The more details that are included, the more specific the address becomes and the easier it is to find.

The Layer at which the switch operates is determined by how much addressing detail the switch reads as data passes through.

Switches can also be considered low end or high end. A low-end switch operates in Layer 2 of the OSI Model and can also operate in a combination of Layers 2 and 3. High-end switches operate in Layer 3, Layer 4, or a combination of the two.

Layer 2 Switches (The Data-Link Layer)

Layer 2 switches operate using physical network addresses. Physical addresses, also known as link-layer, hardware, or MAC-layer addresses, identify individual devices. Most hardware devices are permanently assigned this number during the manufacturing process.

Switches operating at Layer 2 are very fast because they’re just sorting physical addresses, but they usually aren’t very smart—that is, they don’t look at the data packet very closely to learn anything more about where it’s headed.

Layer 3 Switches (The Network Layer)

Layer 3 switches use network or IP addresses that identify locations on the network. They read network addresses more closely than Layer 2 switches—they identify network locations as well as the physical device. A location can be a LAN workstation, a location in a computer’s memory, or even a different packet of data traveling through a network.

Switches operating at Layer 3 are smarter than Layer 2 devices and incorporate routing functions to actively calculate the best way to send a packet to its destination. But although they’re smarter, they may not be as fast if their algorithms, fabric, and processor don’t support high speeds.

Layer 4 Switches (The Transport Layer)

Layer 4 of the OSI Model coordinates communications between systems. Layer 4 switches are capable of identifying which application protocols (HTTP, SNTP, FTP, and so forth) are included with each packet, and they use this information to hand off the packet to the appropriate higher-layer software. Layer 4 switches make packet-forwarding decisions based not only on the MAC address and IP address, but also on the application to which a packet belongs.

Because Layer 4 devices enable you to establish priorities for network traffic based on application, you can assign a high priority to packets belonging to vital in-house applications such as Peoplesoft, with different forwarding rules for low-priority packets such as generic HTTP-based Internet traffic.

Layer 4 switches also provide an effective wire-speed security shield for your network because any company- or industry-specific protocols can be confined to only authorized switched ports or users. This security feature is often reinforced with traffic filtering and forwarding features.

A terminal server (sometimes called a serial server) is a hardware device that enables you to connect serial devices across a network.

Terminal servers acquired their name because they were originally used for long-distance connection of dumb terminals to large mainframe systems such as VAX™. Today, the name terminal server refers to a device that connects any serial device to a network, usually Ethernet. In this day of network-ready devices, terminal servers are not as common as they used to be, but they’re still frequently used for applications such as remote connection of PLCs, sensors, or automatic teller machines.

The primary advantage of terminal servers is that they save you the cost of running separate RS-232 devices. By using a network, you can connect serial devices even over very long distances—as far as your network stretches. It’s even possible to connect serial devices across the Internet. A terminal server connects the remote serial device to the network, and then another terminal server somewhere else on the network connects to the other serial device.

Terminal servers act as virtual serial ports by providing the appropriate connectors for serial data and also by grouping serial data in both directions into Ethernet TCP/IP packets. This conversion enables you to connect serial devices across Ethernet without the need for software changes.

Because terminal servers send data across a network, security is a consideration. If your network is isolated, you can get by with an inexpensive terminal server that has few or no security functions. If, however, you’re using a terminal server to make network connections across a network that’s also an Internet subnet, you should look for a terminal server that offers extensive security features.