고급 네트워크 엔지니어 면접 질문: 완벽 가이드

! OSPF 활성화
Router(config)# router ospf 1
Router(config-router)# network 192.168.1.0 0.0.0.255 area 0
Router(config-router)# network 10.0.0.0 0.255.255.255 area 1

! 라우터 ID 설정
Router(config-router)# router-id 1.1.1.1

! 수동 인터페이스 구성
Router(config-router)# passive-interface gigabitethernet 0/0

! 확인
Router# show ip ospf neighbor
Router# show ip ospf database
Router# show ip route ospf

! BGP 구성
Router(config)# router bgp 65001
Router(config-router)# neighbor 203.0.113.1 remote-as 65002
Router(config-router)# network 192.168.1.0 mask 255.255.255.0

! BGP 속성
Router(config-router)# neighbor 203.0.113.1 route-map PREFER-PATH in

! 경로 맵
Router(config)# route-map PREFER-PATH permit 10
Router(config-route-map)# set local-preference 200

! 확인
Router# show ip bgp summary
Router# show ip bgp neighbors
Router# show ip bgp

! 인터페이스에서 MPLS 활성화
Router(config)# interface gigabitethernet 0/0
Router(config-if)# mpls ip

! LDP (Label Distribution Protocol) 구성
Router(config)# mpls ldp router-id loopback0 force

! MPLS VPN 구성
Router(config)# ip vrf CUSTOMER_A
Router(config-vrf)# rd 65000:1
Router(config-vrf)# route-target export 65000:1
Router(config-vrf)# route-target import 65000:1

! 인터페이스를 VRF에 할당
Router(config)# interface gigabitethernet 0/1
Router(config-if)# ip vrf forwarding CUSTOMER_A
Router(config-if)# ip address 10.1.1.1 255.255.255.0

! 확인
Router# show mpls ldp neighbor
Router# show mpls forwarding-table
Router# show ip vrf

# SD-WAN 애플리케이션 라우팅 정책
policy = {
    'voice': {
        'priority': 'high',
        'preferred_path': 'mpls',
        'backup_path': 'internet',
        'sla': {
            'latency': '< 100ms',
            'jitter': '< 30ms',
            'packet_loss': '< 1%'
        }
    },
    'video': {
        'priority': 'medium',
        'preferred_path': 'internet',
        'bandwidth': '5 Mbps',
        'sla': {
            'latency': '< 150ms',
            'packet_loss': '< 2%'
        }
    },
    'web': {
        'priority': 'low',
        'load_balance': ['internet', 'lte'],
        'sla': {
            'latency': '< 300ms'
        }
    }
}

! 라우터 1 (Active)
Router1(config)# interface gigabitethernet 0/0
Router1(config-if)# ip address 192.168.1.2 255.255.255.0
Router1(config-if)# standby 1 ip 192.168.1.1
Router1(config-if)# standby 1 priority 110
Router1(config-if)# standby 1 preempt

! 라우터 2 (Standby)
Router2(config)# interface gigabitethernet 0/0
Router2(config-if)# ip address 192.168.1.3 255.255.255.0
Router2(config-if)# standby 1 ip 192.168.1.1
Router2(config-if)# standby 1 priority 100

! RSTP 구성
Switch(config)# spanning-tree mode rapid-pvst

! 루트 브리지 설정
Switch(config)# spanning-tree vlan 1-100 root primary

! 액세스 포트용 PortFast
Switch(config)# interface range fastethernet 0/1-24
Switch(config-if-range)# spanning-tree portfast

# RF 계획 요소
- 커버리지 영역
- 사용자 밀도
- 애플리케이션 요구 사항
- 건축 자재
- 간섭 원인

# 도구
- Ekahau Site Survey
- AirMagnet Survey
- NetSpot

! AP 채널 구성
ap dot11 24ghz shutdown
ap dot11 24ghz channel 1
ap dot11 24ghz power-level 3
ap dot11 24ghz no shutdown

ap dot11 5ghz shutdown
ap dot11 5ghz channel 36
ap dot11 5ghz power-level 2
ap dot11 5ghz no shutdown

! 802.11r 활성화
wlan CORPORATE 1 CORPORATE
 security wpa akm ft psk
 security wpa akm ft dot1x
 mobility anchor 10.1.1.1

! RADIUS 구성
wlan CORPORATE 1 CORPORATE
 security wpa akm dot1x
 security wpa wpa3
 security wpa cipher aes
 radius server auth RADIUS-SERVER

! RADIUS 서버
radius server RADIUS-SERVER
 address ipv4 10.1.1.100 auth-port 1812 acct-port 1813
 key MySecretKey

! 게스트 WLAN
wlan GUEST 2 GUEST
 security open
 security web-auth
 security web-passthrough
 no security wpa
 no security wpa wpa2
 no security wpa wpa3

! 클라이언트 격리
wlan GUEST 2 GUEST
 peer-blocking drop

! 음성 트래픽 우선 순위 지정
wlan CORPORATE 1 CORPORATE
 qos wmm required

! Platinum QoS 프로필
qos profile VOICE
 priority platinum
 average-data-rate 6000
 burst-data-rate 6000

# AP 요구 사항 계산
def calculate_aps(area_sqft, users, throughput_per_user_mbps):
    # 커버리지 기반
    coverage_per_ap = 5000  # sq ft (환경에 따라 다름)
    aps_for_coverage = area_sqft / coverage_per_ap
    
    # 용량 기반
    ap_throughput = 300  # Mbps (802.11ac에 대한 현실적인 값)
    users_per_ap = 25  # 권장 최대값
    
    total_throughput = users * throughput_per_user_mbps
    aps_for_capacity = total_throughput / ap_throughput
    
    # 더 높은 값 사용
    return max(aps_for_coverage, aps_for_capacity)

# 예제
required_aps = calculate_aps(
    area_sqft=50000,
    users=500,
    throughput_per_user_mbps=2
)
print(f"필요한 AP 수: {required_aps}")

! 표준 ACL
Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 10 deny any

! 확장 ACL
Router(config)# ip access-list extended BLOCK-TELNET
Router(config-ext-nacl)# deny tcp any any eq 23
Router(config-ext-nacl)# permit ip any any

! 인터페이스에 적용
Router(config)# interface gigabitethernet 0/0
Router(config-if)# ip access-group BLOCK-TELNET in

! 포트 보안 활성화
Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# switchport port-security mac-address sticky

! IPsec VPN
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14

crypto isakmp key MySecretKey address 203.0.113.1

crypto ipsec transform-set MYSET esp-aes 256 esp-sha256-hmac

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set transform-set MYSET
 match address VPN-TRAFFIC

! 클래스 맵 (트래픽 식별)
Router(config)# class-map match-any VOICE
Router(config-cmap)# match protocol rtp
Router(config-cmap)# match ip dscp ef

Router(config)# class-map match-any VIDEO
Router(config-cmap)# match protocol http

! 정책 맵 (동작 정의)
Router(config)# policy-map QOS-POLICY
Router(config-pmap)# class VOICE
Router(config-pmap-c)# priority percent 30
Router(config-pmap-c)# class VIDEO
Router(config-pmap-c)# bandwidth percent 40
Router(config-pmap-c)# class class-default
Router(config-pmap-c)# fair-queue

! 인터페이스에 적용
Router(config)# interface gigabitethernet 0/0
Router(config-if)# service-policy output QOS-POLICY

! 확인
Router# show policy-map interface gigabitethernet 0/0

from netmiko import ConnectHandler
import getpass

# 장치 연결
device = {
    'device_type': 'cisco_ios',
    'host': '192.168.1.1',
    'username': 'admin',
    'password': getpass.getpass(),
    'secret': getpass.getpass('Enable password: ')
}

# 연결 및 명령 실행
with ConnectHandler(**device) as conn:
    conn.enable()
    
    # Show 명령
    output = conn.send_command('show ip interface brief')
    print(output)
    
    # 구성 명령
    config_commands = [
        'interface GigabitEthernet0/1',
        'description Uplink to Core',
        'ip address 10.1.1.1 255.255.255.0',
        'no shutdown'
    ]
    output = conn.send_config_set(config_commands)
    print(output)
    
    # 구성 저장
    conn.save_config()

# inventory/hosts
[routers]
router1 ansible_host=192.168.1.1
router2 ansible_host=192.168.1.2

[routers: vars]
ansible_network_os=ios
ansible_connection=network_cli
ansible_user=admin
ansible_password=vault_encrypted_password

# playbooks/configure_interfaces.yml
---
- name: 라우터 인터페이스 구성
  hosts: routers
  gather_facts: no
  tasks:
    - name: 인터페이스 설명 구성
      ios_config:
        lines:
          - description Configured by Ansible
        parents: interface GigabitEthernet0/1
    
    - name: IP 주소 구성
      ios_l3_interface:
        name: GigabitEthernet0/1
        ipv4: 10.1.1.1/24
        state: present
    
    - name: 인터페이스 활성화
      ios_interface:
        name: GigabitEthernet0/1
        enabled: true
    
    - name: 구성 저장
      ios_command:
        commands:
          - write memory

import requests
from requests.auth import HTTPBasicAuth
import json

# RESTCONF 예제
url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces'
headers = {
    'Content-Type': 'application/yang-data+json',
    'Accept': 'application/yang-data+json'
}
auth = HTTPBasicAuth('admin', 'password')

# 인터페이스 가져오기
response = requests.get(url, headers=headers, auth=auth, verify=False)
interfaces = response.json()
print(json.dumps(interfaces, indent=2))

# 인터페이스 구성
interface_config = {
    "ietf-interfaces:interface": {
        "name": "GigabitEthernet0/1",
        "description": "Configured via RESTCONF",
        "type": "iana-if-type:ethernetCsmacd",
        "enabled": True,
        "ietf-ip:ipv4": {
            "address": [{
                "ip": "10.1.1.1",
                "netmask": "255.255.255.0"
            }]
        }
    }
}

response = requests.put(
    f"{url}/interface=GigabitEthernet0/1",
    headers=headers,
    auth=auth,
    data=json.dumps(interface_config),
    verify=False
)
print(f"상태: {response.status_code}")

import os
from datetime import datetime
from netmiko import ConnectHandler

def backup_device_config(device_info, backup_dir='/backups'):
    """장치 구성 백업"""
    try:
        # 장치에 연결
        with ConnectHandler(**device_info) as conn:
            conn.enable()
            
            # 실행 중인 구성 가져오기
            config = conn.send_command('show running-config')
            
            # 백업 파일 이름 생성
            hostname = conn.send_command('show run | include hostname').split()[1]
            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
            filename = f"{backup_dir}/{hostname}_{timestamp}.cfg"
            
            # 파일에 저장
            os.makedirs(backup_dir, exist_ok=True)
            with open(filename, 'w') as f:
                f.write(config)
            
            print(f"[+] 백업 저장됨: {filename}")
            return True
    except Exception as e:
        print(f"[-] 백업 실패: {e}")
        return False

# 여러 장치 백업
devices = [
    {'device_type': 'cisco_ios', 'host': '192.168.1.1', 'username': 'admin', 'password': 'pass'},
    {'device_type': 'cisco_ios', 'host': '192.168.1.2', 'username': 'admin', 'password': 'pass'},
]

for device in devices:
    backup_device_config(device)

# 네트워크 상태 유효성 검사
def validate_network(device):
    """네트워크 구성 및 상태 유효성 검사"""
    with ConnectHandler(**device) as conn:
        conn.enable()
        
        checks = {
            'interfaces_up': [],
            'bgp_neighbors': [],
            'ospf_neighbors': [],
            'issues': []
        }
        
        # 인터페이스 상태 확인
        output = conn.send_command('show ip interface brief')
        for line in output.split('\n')[1:]:
            if 'up' in line.lower():
                checks['interfaces_up'].append(line.split()[0])
            elif 'down' in line.lower() and 'administratively' not in line.lower():
                checks['issues'].append(f"인터페이스 다운: {line.split()[0]}")
        
        # BGP 이웃 확인
        output = conn.send_command('show ip bgp summary')
        # BGP 이웃 구문 분석
        
        # OSPF 이웃 확인
        output = conn.send_command('show ip ospf neighbor')
        # OSPF 이웃 구문 분석
        
        return checks

! 인터페이스 확인
show ip interface brief
show interfaces status

! 라우팅 확인
show ip route
show ip protocols

! 이웃 확인
show cdp neighbors
show lldp neighbors

! 로그 확인
show logging

# tcpdump
tcpdump -i eth0 -w capture.pcap

# Wireshark 필터
tcp.port == 80
ip.addr == 192.168.1.1
http.request.method == "GET"

# SNMP 모니터링
snmpwalk -v2c -c public 192.168.1.1

# NetFlow 분석
# 트래픽 패턴 분석
# 대역폭 점유율 식별
# 이상 징후 감지

! 듀플렉스 불일치
show interfaces gigabitethernet 0/0
interface gigabitethernet 0/0
 duplex auto
 speed auto

! 라우팅 루프
show ip route
traceroute 192.168.1.1

! VLAN 불일치
show vlan brief
show interfaces trunk