Networking Concepts · Topic 2 of 11
Networking Appliances and Functions
Compare routers, switches, firewalls, IDS and IPS, load balancers, proxies, access points, NAS and SAN, plus CDN, VPN, QoS and TTL functions for Network+.
- 5 min
- A switch forwards by MAC address at layer 2. A router forwards by IP address at layer 3.
- A Layer 3 switch routes between VLANs. A traditional Layer 2 switch cannot.
- An IDS detects and alerts. An IPS sits inline and can block.
What it is
A networking appliance is a device, physical or virtual, that moves, filters or manages traffic. The exam asks you to pick the right one for a scenario and to know what each one does.
Many appliances exist as a physical box, a virtual machine or a cloud service. The function stays the same, but a virtual appliance runs on a hypervisor and is easier to copy and scale.
How it works
Core forwarding devices
| Device | Layer | What it does |
|---|---|---|
| Switch | 2 | Forwards frames by destination Media Access Control (MAC) address inside one network |
| Layer 3 switch | 2 and 3 | Switches frames and also routes between VLANs at high speed |
| Router | 3 | Forwards packets between different networks using Internet Protocol (IP) addresses |
| Access point (AP) | 1 and 2 | Connects wireless clients to the wired local area network (LAN) |
| Wireless LAN controller | Management | Configures and manages many APs from one place |
| Range extender | 1 | Repeats a wireless signal to cover a larger area |
A Virtual Local Area Network (VLAN) splits one switch into separate broadcast domains. A Layer 3 switch or router is needed to move traffic between them.
Security and traffic control devices
A firewall allows or blocks traffic by rules. A stateful firewall tracks connections, while a next generation firewall (NGFW) also understands applications and can inspect content.
An Intrusion Detection System (IDS) watches a copy of traffic and raises alerts. An Intrusion Prevention System (IPS) sits in the traffic path and can block the attack as well.
A proxy makes requests on behalf of clients. A forward proxy serves internal users going out and can filter or cache. A reverse proxy sits in front of servers and receives requests from outside.
A load balancer spreads client requests across several servers. It improves capacity and availability, and it removes a failed server from the pool using health checks.
Storage and voice
| Appliance | Description |
|---|---|
| Network attached storage (NAS) | File level storage shared over the network, for example with Server Message Block (SMB) or Network File System (NFS) |
| Storage area network (SAN) | Block level storage presented to servers as if it were a local disk |
| Voice over IP (VoIP) phone and gateway | IP based telephones, with a gateway that links to the traditional phone network |
Functions and applications
| Function | Purpose |
|---|---|
| Content delivery network (CDN) | Caches content on servers close to users to lower latency and offload the origin |
| Virtual private network (VPN) | Creates an encrypted tunnel across an untrusted network |
| Quality of Service (QoS) | Prioritizes important traffic, such as voice, when links are busy |
| Time to Live (TTL) | A hop counter in the IP header that is reduced by each router and stops loops |
A VPN can join two sites (site to site) or connect one user to a network (client to site). A clientless VPN uses a web browser instead of installed software.
With a full tunnel, all of the client's traffic goes through the VPN. With a split tunnel, only traffic for the company network does, and the rest goes straight to the internet.
When a packet's TTL reaches zero, the router drops it and sends an Internet Control Message Protocol (ICMP) Time Exceeded message back. The traceroute tool uses this behavior to list each hop.
QoS works by classifying traffic, marking it and then queuing it so that sensitive flows go first. Voice and video are sensitive to delay and jitter, so they get higher priority than bulk file transfers.
What to remember for the exam
- A switch forwards by MAC address at layer 2. A router forwards by IP address at layer 3.
- A Layer 3 switch routes between VLANs. A traditional Layer 2 switch cannot.
- An IDS detects and alerts. An IPS sits inline and can block.
- A forward proxy protects and serves clients. A reverse proxy protects and serves servers.
- A load balancer distributes traffic across servers and improves availability.
- NAS is file level storage. A SAN is block level storage.
- A CDN caches content near users. QoS prioritizes traffic. TTL limits how long a packet can live.
- A wireless LAN controller manages many access points centrally.
- Virtual appliances run on a hypervisor, which makes them easy to deploy and copy.
Match the verb to the device. "Alert" means IDS, "block inline" means IPS, "spread across servers" means load balancer, "cache near users" means CDN.
Common mistakes
Confusing IDS and IPS. An IDS is passive and only alerts. An IPS is placed inline and acts on traffic, so a failure of an inline IPS can interrupt traffic.
Mixing NAS and SAN. NAS shares files over standard network protocols. A SAN gives servers raw blocks, usually over a dedicated storage network.
Assuming a switch routes. A Layer 2 switch only forwards inside one broadcast domain. Routing between VLANs needs a router or a Layer 3 switch.
Mixing the two proxy types. The direction matters. A forward proxy represents clients, and a reverse proxy represents servers.
Treating a VPN as a firewall. A VPN protects data in transit through encryption. It does not decide which traffic is allowed.
A load balancer improves availability only if it is not itself a single point of failure. Real designs use a pair of load balancers or a managed cloud service.
Check yourself
Try these three questions.
Which device is placed in the traffic path and can drop an attack?
An Intrusion Prevention System (IPS), because it works inline and can block traffic.
A company wants employees to use cached copies of web content from servers near them. What is that service?
A content delivery network (CDN).
What is the difference between NAS and a SAN?
NAS provides file level access over the network, while a SAN provides block level storage to servers.
Topic 2 of 11 in Networking Concepts
Test yourself on Networking Concepts
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.