preguntas y respuestas cisco ccna

preguntas y respuestas cisco ccna.12.2 Basic Topics 167(1) Asymmetric TunnelingWhen intra-controller roaming occurs on the client, the database entries are transferred to the new controller, which is not a Layer 3 roaming. In the case of 3-tier roaming, the client entry in the initial controller is marked as an anchor entry and then does not move the database entry; instead, the database entry is copied to the external controller. On the external controller, the entry is marked as "Foreign". The client is then re-authenticated and the entry is updated within the new AP, whereupon the client can function well and the IP address of the client remains the same. All of this is transparent to the user. Figure 12-9 depicts this process.Figure 12.93 Layer RoamingTypically when a client sends traffic, it is assumed that the traffic is leaving the subnet and going to its destination, the traffic will be sent to a default gateway. And the return traffic follows the reverse path of its sending path back to the client. That is, if controller 1 sends traffic to reach router 1 first, and then server 1, then server 1 returns the traffic by first going through router 1 and then reaching controller 1, as shown in Figure 12-10.After a client roams to a new controller and a new AP, the return traffic is not sent to the correct controller. So when the anchor controller sees that the return traffic is destined for a client whose entry is marked as an anchor, it knows that it needs to tunnel this traffic to the external controller. Once the external controller receives these packets, it forwards them to the client and all is well. This is how asymmetric tunneling works.However, there are some problems with this configuration. Today's networks employ more and more security precautions.3 One type of precaution is Reverse Path Filtering (RPF, ReversePathFiltering), which is a feature of routers. The router checks all incoming packets on an interface to make sure that both the source address and the source interface of those packets can be found in the routing table and match the interface on which the packet was received. And also follow RFC 3827 and some other anti-spoofing ACL recommendations to discard the packet if the source address does not match what is expected. What should we do when this happens? The answer is symmetric tunneling.168 Chapter 12 Increasing Mobility Through RoamingFigure 12-10 Original Service Flow(2) Symmetric Tunneling