Domain 1 of 5 · Chapter 2 of 9

Networking Appliances

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing CompTIA Network+ premium course — no separate purchase.

Included in this chapter:

  • Forwarding appliances by layer: hub, switch, router
  • Security appliances: firewalls, IDS, and IPS
  • Traffic, proxy, storage, and wireless appliances
  • Exam-pattern recognition

Appliance by OSI layer and primary job

ApplianceOSI layerDecides onPrimary job
Hub / repeaterLayer 1Nothing (signal only)Regenerate and flood bits
SwitchLayer 2MAC addressForward frames within a broadcast domain
Router / L3 switchLayer 3IP addressRoute between networks, terminate broadcast domain
Stateful firewallLayer 3-4IP, port, connection statePermit/deny by ACL, track sessions
NGFW / WAF / proxyLayer 7Application content (URL, payload)Inspect and filter app-layer traffic
IDSLayer 3-7 (out-of-band)Copy of trafficDetect and alert, no blocking
IPSLayer 3-7 (inline)Live traffic in pathDetect and block in real time
Load balancerLayer 4 or Layer 7IP/port or URL/cookieDistribute load across a server pool
NASLayer 7 (file)File requests (NFS/SMB)Serve a shared file system over the LAN
SANBlock over fabricBlock I/O (FC/iSCSI)Serve raw block volumes on a dedicated fabric
Wireless LAN controllerManages L2 APsAP config and clientsCentrally manage lightweight access points

Decision tree

What is the job?move, secure, or storeMove trafficSecure trafficServe storageDecide on which address?MAC, IP, or spread loadMACIPpoolSwitchL2Router / L3 switchL3Load balancerL4 port / L7 URLBlock or just detect?act vs alertBlockDetectRead payload?L7 content vs L3-4Yes (web)NoWAF / NGFWL7 inlineStateful firewallL3-4 inline + IPSIDSout-of-band, alertFiles or raw blocks?NFS/SMB vs LUNFilesBlocksNASfile over LANSANblock over fabricInline = adds latency, single point of failureOut-of-band = zero latency, detect onlyHub (L1) only floods bitsnever the answer for selective forwarding
Cheat sheet

Cheat sheet

  • Identify a networking appliance by the OSI layer it reads to decide
  • A hub is a Layer 1 repeater that floods every bit, making no decision
  • A switch forwards by MAC address and extends a broadcast domain
  • A router forwards by IP between networks and terminates the broadcast domain
  • A Layer 3 switch routes between VLANs in hardware at wire speed
  • A stateless packet filter checks each packet alone and is blind to payload
  • A stateful firewall tracks sessions and auto-permits the return traffic
  • Use a WAF or NGFW at Layer 7 to block web-application attacks
  • A UTM bundles many security functions into one box for small sites
  • A firewall ruleset ends in an implicit deny, so explicit allows go on top
  • An IDS is out-of-band and only detects; an IPS is inline and can block
  • An inline IPS adds latency and risk; an out-of-band IDS adds neither
  • A load balancer is active and inline, health-checking a server pool
  • A Layer 4 load balancer uses IP and port; Layer 7 uses URL, host, or cookie
  • A forward proxy fronts clients; a reverse proxy fronts servers
  • NAS serves files over the LAN; SAN serves raw blocks over a fabric
  • iSCSI carries block SCSI commands over IP as a SAN alternative to Fibre Channel
  • A wireless LAN controller centrally manages lightweight access points
  • A firewall's OSI layer depends on what it inspects, not the label firewall
  • A stateful firewall tracks UDP as a pseudo-session that an idle timer expires
  • A stateful firewall validates TCP by flags and sequence against its state table, and can drop idle sessions
  • A network IPS reassembles the TCP stream before matching, and can inject RSTs to kill a session
  • A perimeter IPS only sees north-south traffic and misses lateral east-west movement

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Cisco Switches: access, distribution, and core campus layers
  2. NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy Whitepaper
  3. NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems (IDPS) Whitepaper
  4. What is Elastic Load Balancing?
  5. Amazon EBS: Block storage volumes