Shared Flashcard Set


8.Defining Network Infrastructure and security
From the MVA course "Networking Fundamentals"
Computer Networking

Additional Computer Networking Flashcards







The Internet is a worldwide system of connected computer networks.


Devices that connect to the Internet use the TCP/IP protocol suite.

The Internet contains a lot of information, resources and services:

  • World Wide Web (WWW) servers hosting content
  • Supporting infrastructure for email
  • Connectivity for peer-to-peer networks

World Wide Web


Enormous system of interlinked hypertext documents that can be accessed by using a web browser.


Currently, the World Wide Web is in a stage known as Web 2.0.

Web 2.0 is an interactive type of web experience compared to the previous version 1.0.







An intranet is a private computer network or single Web site that an organization implements in order to share data with employees around the world.


User authentication is necessary before a person can access the information in an intranet.

Ideally, this keeps the general public out, as long as the intranet is properly secured.







An extranet is similar to an intranet except that it is extended to users outside a company, and possibly to entire organizations that are separate from or lateral to the company.


User authentication is still necessary, and an extranet is not open to the general public.





Accessing Company Data

A company can present information to different groups:



Intranet – For internal employees

Extranet – For partners

Web Server – For the public







Virtual private network

Connection between two or more computers or devices that are not on the same private network.


In order to ensure that only the proper users and data sessions cross to a VPN device, data encapsulation and encryption are used.


A “tunnel’ is created, through the LANs and WANs that are being used.





VPN protocols


Point-to-Point Tunneling Protocol (PPTP)

Encapsulates Point-to-Point (PPP) frames into IP datagrams for transmission over an IP-based network (data isn’t encrypted by default).


Layer Two Tunneling Protocol with Internet Protocol Security (L2TP/IPSec)


Combination of PPTP and Layer 2 Forwarding (L2F) a technology from Cisco Systems, Inc, IPSec is used to encrypt the message.





Point to Point tunneling protocol


Allows multiprotocol traffic to be encrypted and then encapsulated in an IP header to be sent across an IP network or a public IP network.


Can be used for remote access and site-to-site VPN connections.

Encapsulates PPP frames in IP datagrams for transmission.

Uses a TCP connection for tunnel management and a modified version of Generic Routing Encapsulation (GRE) to encapsulate PPP frames.


The payload of the encapsulated PPP frame can be encrypted, compressed or both.





L2TP with IPSec


Allows multiprotocol traffic to be encrypted and then sent over any medium that supports point-to-point datagram delivery.


Relies on IPSec in Transport Mode for encryption services.


Encapsulation for L2TP/IPSec packets consists of two layers:


L2TP Encapsulation

PPP frame is wrapped with an L2TP and UDP header.


IPSec Encapsulation

The L2TP message is wrapped with an IPSec

Encapsulating Security Payload (ESP) header and trailer, and an IPSec Authentication Trailer.







Firewalls are used to help protect a network from malicious attack and unwanted intrusion.


They are the most commonly used type of security device in an organization’s perimeter.





Packet filtering


Packet filtering inspects each packet that passes through the firewall and accepts or rejects it based on a set of rules.


Stateless packet inspection does not retain memory of packets that have passed through the firewall.


Stateful packet inspection (SPI) maintain context about active sessions.





NAT Filtering


AKA NAT endpoint filtering, filters traffic according to ports (TCP or UDP).


This can be done in three ways:

  • Using basic endpoint connections.
  • Matching incoming traffic to the corresponding outbound IP address connection.
  • Matching incoming traffic to the corresponding IP address and port.




Application level Gateway


Supports address and port translation and checks whether the type of application traffic is allowed.


It adds a layer of security; however, it is resource intensive.





Circuit level gateway


Works at the session layer of the OSI model when a TCP or UDP connection is established.


Circuit-level filtering inspects sessions rather than connections or packets.

Once the connection has been made, packets can flow between the hosts without further checking.


Circuit-level gateways hide information about the private network, but they do not filter individual packets.





Proxy Server


Acts as an intermediary between a LAN and the Internet.


By definition, proxy means “go-between,” acting as such a mediator between a private and a public network.


The proxy server evaluates requests from clients, and if they meet certain criteria, forwards them to the appropriate server.





Caching proxy


Attempts to serve client requests without actually contacting the remote server.


Although there are FTP and SMTP proxies among others, the most common caching proxy is the HTTP proxy, also known as a web proxy, which caches web pages from servers on the Internet for a set amount of time.


This is done to save bandwidth on the company’s Internet connection and to increase the speed at which client requests are carried out.





IP Proxy


IP proxy secures a network by keeping machines behind it anonymous.

It does this through the use of NAT.





Internet Content Filter


An Internet content filter, or simply a content filter, is usually applied as software at the application layer and it can filter out various types of Internet activities, such as access to certain Web sites, email, instant messaging, and so on.





Network intrusion detection and prevention


A network intrusion detection system(NIDS) is a type of IDS that attempts to detect malicious network activities (e.g., port scans and DoS attacks) by constantly monitoring network traffic.


The NIDS will then report any issues that it finds to a network administrator as long as it is configured properly.


A network intrusion prevention system (NIPS) is designed to inspect traffic, and, based on its configuration or security policy, it can remove, detain, or redirect malicious traffic in addition to simply detecting it.





Perimeter network


Small network that is set up separately from a company’s private local area network and the Internet.


It is called a perimeter network because it is usually on the edge of a LAN, but DMZ is an industry standard term.


A perimeter network allows users outside a company LAN to access specific services located on the DMZ.


When the perimeter network is set up properly, those users are blocked from gaining access to the company LAN.


The perimeter network might house a switch with servers connected to it that offer web, email, and other services.


Perimeter network configuration


Back-to-back configuration


This configuration has the perimeter network situated between two firewall devices, which could be black box appliances or Microsoft Internet Security and Acceleration (ISA) Servers.


3-leg perimeter configuration


In this scenario, the perimeter network is usually attached to a separate connection of the company firewall.

Therefore, the firewall has three connections

  • one to the company LAN
  • one to the perimeter network
  • one to the Internet
Supporting users have an ad free experience!