Professional Documents
Culture Documents
CCNP Switch Notes
CCNP Switch Notes
L2 switch
Type of MLS
TCAM table
MLS switching
CEF
Advanced CEF
Fallback bridging
10
Adjacency table
10
11
Hardware
12
Catalyst 5000/5500
12
Catalyst 3750
14
Catalyst 4500
14
15
16
Fast Ethernet
16
Gigabit Ethernet
16
10 Gigabit Ethernet
17
Autonegotiation
17
Summary
19
VLAN
20
VLAN 1
21
Trunk design
21
Trunking protocols
21
InterVLAN routing
22
802.1Q-in-Q tunneling
23
PPPoE
24
VTP
VTP update advertisement
25
25
VTP version 3
28
Miscellaneous
28
EtherChannel
29
PAgP
29
LACP, 802.3ad
30
Configuration
31
Algorithm
32
STP
33
Type of BDPU
33
Port costs
34
Port states
34
Types of STP
35
STP configuration
35
General
35
Timers
36
Port ID
36
36
BackboneFast
37
Verification
37
Additional features
38
Root Guard
38
BPDU Guard
38
BPDU Filter
38
Loop Guard
38
UDLD
39
RSTP
41
BPDU
41
Port
41
Synchronization
42
Topology Change
42
Compatibility
42
43
44
MST configuration
45
46
46
46
47
48
49
HSRP
49
HSRP election
50
HSRP messages
50
HSRP states
50
HSRP authentication
51
Interface track
51
HRSP load-balance
51
VRRP
52
GLBP
52
53
Weighting feature
53
Load-balance algorithm
54
IP phone
55
55
56
QoS
57
57
58
Configuration
59
Wireless
61
AP Basics
61
802.11 Basics
62
802.11 frames
62
63
CUWNA roaming
64
Switch configuration
65
Security
Port Security
66
66
DHCP snooping
67
67
IP source guard
68
VLAN hopping
69
69
Switch ACLs
71
PVLAN
72
72
Error management
73
75
76
76
Macro
77
77
StackWise
77
Power redundancy
78
L2 switch
When a frame arrives at a switch port, its placed into one of the ingress queues. Each
ingress queues have a different priority service level, so the higher priority queues gets
faster service, this prevents time (latency: the time takes from a frame enters the switch to
leaving it) sensitive frames from being last.
Not only does the switch has to figure out WHERE to send a frame, it also has to figure to
WHETHER it should and HOW. These are the factors affecting the process, each is operated
separately:
- L2 forwarding table, or CAM table.
- Security ACL placed in ternary CAM or TCAM table deciding whether a frame should leave
- QoS ACL determines which egress queue a frame will go, each queue has different priority
to prevent time-sensitive information from delay. Also stored in TCAM table.
When frames come in, all ACLs are run in parallel to match the frame.
-
When a packet comes in, these components will be involved in its forwarding decision:
L2 forwarding, or CAM table.
L3 forwarding, or FIB table
Security ACLs compiled into TCAM table
QoS ACLs compiled into TCAM table
Type of MLS
Cisco implements route caching (demand-based) and topology-based switching.
Demand-based switching, also known as flow-based switching, or MLS requires 3
components:
- MLS engine (MLS_SE): can identify Layer 3 flow and lie in data plane. It determines next
hop and egress interface for each packet, rewrite the packet as necessary.
- MLS RP: run routing protocol, maintain and update routing table to MLS-SE
- MLSP: multicast protocol (0100.0cdd.dddd) used to communicate information such as
routing changes between RP and SE.
RP can be an internal or external router, internal router can be RSM or RSFC module on
5000/5500. External router can be connected to 7500, or 7200
Steps of packet forwarding:
1. MLS-SE receive a packet, now known as candidate packet, for new flow. Forwarded to
MLS-RP for route lookup if a flow entry is not found already.
2. MLS-RP determine destination, rewrite the packet and forward it. This packet is now an
enable packet. SE records this path in the flow cache.
3. Following packets in the flow (same source & destination address & port number) are
switched using the same path with ASIC and rewrite engine. Note that both the candidate
and enable packet must pass through the same switch.
When supervisor 720 was introduced, this method become legacy and use CEF instead.
Note: router ACL do not affect the processing of SE because SE is never create the flow in
the cache.
Topology-based or CEF switching refers to the switching method which RP build the RIB
and send a copy called FIB (contain all the IP prefix from routing table) to SE, which forward
packet based on next-hop entry of each packet.
When new entries take place, the CEF table is updated, packets are temporarily switched
slower in RP. Special frames such as Telnet are also switch slower as they also use demandbased switching.
TCAM table
ACL are made up of one or more access control entities (ACE) or matching statements that
are implemented in hardware. In MLS, ACL is implemented in
1) Feature manager (FM) merges ACEs into TCAM table.
2) Switching Database Manager (SDM) helps to divide the TCAM if necessary.
TCAM entries are composed of Value, Mask and Result (VMR) combination that matches
from the frame or packet headers from the value and mask pair.
- Value are always 134-bit quantities, consisting of source and destination address and
other info, all of which needed to be matched.
Access List
Type
Ethernet
ICMP
Source IP (32), destination IP (32), protocol (16), ICMP code (8), ICMP type (4), IP
type of service (ToS) (8)
Extended IP
Source IP (32), destination IP (32), protocol (16), IP ToS (8), source port (16),
using TCP/UDP source operator (4), destination port (16), destination operator (4)
Other IP
IGMP
Source IP (32), destination IP (32), protocol (16), IP ToS (8), IGMP message type (8)
IPX
Source IPX network (32), destination IPX network (32), destination node (48), IPX
packet type (16)
- Mask is also a 134-bit quantity in the exact format, but it does a different job. It turns on
(1) the things needed to be matched and turn off bits not to be matched.
- Results are used to inform switches of the action to take after the lookup occurs.
TCAM table is organized by masks, each unique mask has 8 value patterns. However, some
keywords such as gt lt neq, or range, have more than one match, thus FM comes into
play and compile TCAM entry using logical operation unit (LOU) register pairs.
However, since there are only limited LOUs, if there are more comparison operator than
LOUs, FM must break down ACE for the statement to process.
If too many items are presented in the TCAM table, an overflow may occur due to low on
system resource. This will generate a syslog error.
CEF
CEF operates at the data plane and increase efficiency by using FIB and adjacency table.
The adjacency table is created to contain all connected next hops. As soon as a neighbor is
connected, it will use a MAC string/rewrite to reach that device, then an entry will be stored
in the adjacency table.
A CEF-based multilayer switch consists of two basic functional blocks:
- Layer 3 engine is involved in building routing information stored in FIB, which rearrange
the routing table so the most specific routes are placed in front of other routes. The entry
also include the next-hop address.
- Layer 3 forwarding engine that switch packets in hardware
The host route, or 255.255.255.255 is also found in the FIB. If change take place in
routing table or ARP table, it will be reflected on the FIB. To display FIB, use show ip cef
[TYPE MOD/NUM | vlan VID] [PREF_IP MASK] [longer-prefixes] [detail]
Most of the time, Layer 3 forwarding engine check the packet and forward it using
hardware, but in the following instances, these packets will be marked CEF punt and send
to Layer 3 engine for further processing:
- Entry cant be found in FIB
- FIB is full
- TTL is expired
- MTU is exceeded, fragmentation required
- ICMP redirect is involved
- Encapsulation type is not supported
- Packets are tunneled, requiring compression or encryption
- Involves ACL with log keyword
- NAT operation (exception: Catalyst 6500 Supervisor 720 can handle NAT in hardware)
- ARP requests and replies
- IP packets that require a response from the router (such as decrementing TTL, MTU
match, fragmentation, etc)
- IP broadcast that will be relayed as unicast (IP helper-address)
- Routing protocol updates
- CDP packets
- IPX routing protocol and service advertisement
- Non IP or IPX protocol
Advanced CEF
As performance demand increase, Layer 3 engine also increased its capability. In Catalyst
6500, CEF is being optimized with special forwarding hardware and accelerated CEF or
distributed CEF.
Accelerated CEF allows a portion of the FIB to be distributed to capable line card modules
in the Catalyst 6500 switch. This allows the forwarding decision to be made on the local line
card using the locally stored scaled-down CEF table. In the event that FIB entries are not
found in the cache, requests are sent to the Layer 3 engine for more FIB information.
Distributed CEF refers to the use of multiple CEF tables distributed across multiple line
cards installed in the chassis. When using dCEF, the Layer 3 engine (MSFC) maintains the
routing table and generates the FIB, which is then dynamically downloaded in full to each of
the line cards, allowing for multiple Layer 3 data plane operations to be performed
simultaneously.
To enable CEF, use (config)#ip cef [distributed]. To disable, use (config)#no ip cef
[distributed] or (config)#no ip route-cache cef.
Verify with show ip cef [TYPE MOD/NUM] [detail]
Fallback bridging
Not all routed protocols are supported. Depending on the platform, unsupported routed
protocol must be routed using software while some cant even be routed. The non-routable
protocols can be bridged between different VLANs and routed interfaces of the same bridge
group using fallback bridging, which allows the switch to forward this traffic.
Fallback bridging is enabled by assigning 2 or more switch interfaces to a bridge group.
Once the interfaces have been assigned to a bridge group, the interfaces are able to bridge
all non-routed traffic between them and other member interfaces. BPDUs are exchanged
between members of same bridge group, but not between groups. Note:
- Up to a maximum of thirty two (32) bridge groups can be configured on the switch
- An interface (an SVI or routed port) can be a member of only one bridge group
- Use a different bridge group for each separately bridged network connected to the switch
- Do not configure fallback bridging on a switch configured with private VLANs
- When enabled, all protocols are bridged, except for the following:
IP Version 4
IP Version 6
Address Resolution Protocol (ARP)
Reverse ARP (RARP)
Frame Relay ARP
Shared STP packets are fallback bridged
Configure a bridge group with (config)#bridge [1 - 255] protocol vlan-bridging command,
know that only 32 VLANs are supported. Then configured a L3 interface to participate in a
bridge group with (config-if)#bridge-group [1 - 255]
Verify with show bridge [NO] [group] [verbose] command.
Adjacency table
Another table used for maintain a list of next-hop neighbor and directly connected hosts
MAC address and its correspondent IP address; this table is called the adjacency table and
is built from the ARP table. You can display this table with show adjacency [TYPE MOD/NUM
| vlan VID] [summary | detail].
You will see a line of hexadecimal values, the first 12 digits is the MAC address of the
attached host. Another 12 digits contain the MAC address of this Layer 3 engines interface,
with the last 4 digit denoting the EtherType.
If an ARP entry is missing, the corresponding FIB entry is marked CEF glean, meaning
the frame cant be processed due to the missing of the layer 2 address. This causes the
layer 3 engine to generate an ARP request for that address. You can show a list of FIB
entries in glean state with show ip cef adjacency glean command.
When an entry is in glean state, packets for that destination is dropped to prevent sending
multiple ARP request, this is known as ARP throttling or throttling adjacency. If an ARP reply
is not received within the next 2 seconds, another ARP is released.
An adjacency refers to 2 MLS connected by a common link.
Hardware
Switching fabric is a term used for communication channel used by the switch to transport
frames, carry forwarding decision information, and relay management information
throughout the switch. Its responsible to relay frame from ingress port to an egress port.
There are 2 major types of switch fabric
- Shared bus: share the same method of switching. Use a central arbiter to determine how
and when to grant requests from each line card (port). Only one process occurring any
time.
When frame is received, its placed in a buffer (queue) and check for error. Line card local
arbiter request access to transit frame onto data bus. Defective frame are discarded.
Header is added to insist forwarding decision in data bus then transmit there.
Data bus send the frame to all ports (except where the frame come from), then the header
added will decide which port will forward. Certain ports transmit frame, while others discard
it.
- Crossbar solves the waiting problem in shared bus by using multiple line card that can
operate simultaneously. Its available in SFM modules.
As oversubscription can occur any time, its a good idea to buffer excessive frames before
they are processed to prevent being dropped. 2 types of memory management is used to
act as switch frame buffer:
- Port buffer memory: high-speed memory specially designed store excessive frame. One/
port, drop frame if buffer full.
- Shared memory: old type of memory designed for port buffer. All ports share the same
buffer. Dynamically allocate memory for buffer. Vary by different platform, but usually
increment from 64 to 256 bytes.
Head-of-line blocking occurs whenever traffic waiting to be transmitted prevents or blocks
traffic destined elsewhere from being transmitted. This occurs when a receipt port is full and
cant take further requests, or the sending port is too busy.
Cisco Catalyst switches provide many solutions, and one of them is port buffering. Note
that ingress queue is usually much smaller than egress queue as switch can process
incoming frames at a high speed.
Catalyst 5000/5500
Catalyst 5000/5500 (Project Synergy) contains the most fundamental parts of all Cisco
switches.
Catalyst 5000 switch introduced a 5-slot chassis with one slot for supervisor module, hot
swappable line modules, redundant power supply, redundant fans, and 1.2 Gbps backplane
bus.
Catalyst 5500 switches use aggregate switching bandwidth of 3.6 Gbps by using three 1.2
Gbps buses.
Most Catalyst switches are now modular and allow user replacement of components.
Chassis the place where all the components reside. It provides electrical connection
between Supervisor module and all other modules and line cards + system clock to the
power supply.
Model
5000
5002
5005
5009
5500
13
Supervisor Module is the brain of the switch. SM I had the following sub-components:
- Network management processor (NMP) handles administrative functions such as STP
calculation, virtual terminal session, SNMP, and synchronization of secondary Supervisor
Module.
- Master communications processor (MCP) communicates statistical and RMON information
to and from each line modules local communication processor (LCP) to serial
communications protocol (SCP).
- NVRAM
- DRAM or RAM
- Flash memory
- CAM
Supervisor I contain following ASIC:
- Enhanced address recognition logic version (EARL) ASIC: create and update MAC address
to port mapping (CAM table) as well as performing lookups.
- Synergy advanced interface network termination (SAINT) ASIC: provide 10/100 MB
Ethernet controller powering the Supervisors Ethernet uplink port. One SAINT ASIC/uplink
port
- Synergy advanced multipurpose bus arbiter (SAMBA) ASIC: handles central arbitration and
access to data bus.
EARL v1 created CAM tables made up of MAC address, associated VID, and an index value.
The VID field takes 16 bits, but only 10 bits were used to identify a VLAN and the rest are:
- Aging bit: for aging addresses
- Trap bit: indicate an exception, such as filtering or blocking
- Static bit: indicate a MAC address is static
- Valid bit: indicate the entry has a running aging timer, meaning its still valid.
EARL v2 can rewrite header for each packet flow, or give out rewrite information to ASICs
capable of in-line rewrite.
Here are the different Supervisor Module versions:
- I: Layer 2 switching only, not upgradable. Support many different types of media, 2 uplink
ports. No redundancy. Not compatible with 5500
- II: Layer 2 switching only, support optional second supervisor to provide redundancy. 2
uplink ports with different media type.
- IIG: include NFFC and support an optional RSFC. Capable of MLS. Modular Fast and Gigabit
Ethernet uplink ports
- III: support integrated NFFC but not RSFC. Enable 3.6 Gbps crossbar switch fabric with
5500. Modular uplink Gigabit Ethernet ports similar to GBIC
- IIIG: integrated NFFC and support optional RSFC. Enable 3.6 Gbps crossbar switch fabric
with 5500. Modular uplink Gigabit Ethernet ports similar to GBIC
Catalyst 5500 contains 3 buses:
- Switching/data bus (dBus): used to switch frames between line cards. 48 bits wide and
clock rate of 25 MHz, gives 1.2 Gbps bus bandwidth
- Management bus (mBus): carries configuration information from NMP to each module and
back using SCP
- Results/index bus (ruBs): carries port-select information from the central EARL ASIC to
the ports. This information determines which ports forward the packet and which flush it
from the buffer.
Catalyst 3750
3750 series are fixed-configuration switches allowing expansion through the
interconnection or stacking of additional switches rather than adding more line modules.
Uses SFP uplink port.
Model
Ports
Modular Uplinks
WS-C3750-24
24 10/100 Ethernet
2 SFP
WS-C3750-48
48 10/100 Ethernet
4 SFP
WS-C3750G-24T
24 10/100/1000 Ethernet
None
WS-C3750G-24TS
24 10/100/1000 Ethernet
4 SFP
Power supply uses external RPS 675, which can supply power to a maximum of 6 switches,
and provide immediate failover for internal power supply.
Stackwise switches are connected with 68-pin cables. When two or more switches are
connected via Stackwise cables, a switch fabric consisting of dual counter-rotating rings is
formed, with each ring providing 16 Gbps of bandwidth, resulting in 32 Gbps of total
bandwidth. Each ring carries data and is self healing via a loopback protection mechanism
that is enabled should a Stackwise cable or individual switch fail.
This provides high availability even when an ASIC fail.
3750 uses a shared token to determine the order in which port ASCIs may transmit data
onto the ring. The port ASIC can create a 24-byte header containing the necessary
information to make a forward decision.
When transferring a packet, the port ASIC will use the ring that the first token arrives on.
If token from both ring arrive at the same time, port ASIC chooses the least used ring.
The destination port ASIC copies the 24-byte header and the packet data from the ring
and forward it to the correct port.
Catalyst 4500
Model
Catalyst 4500 Series N-slot Chassis
4503
4506
4507R
4510R
10
Catalyst Platform
Form Factor
Switch Fabric
Fabric Bandwidth
5000
Modular
Shared bus
1.2 Gbps
5500
Modular
Crossbar
3.6 Gbps
6000
Modular
Shared bus
32 Gbps
Modular
Crossbar
256 Gbps
Modular
Crossbar
4500
Modular
Centralized
64 Gbps
3750
Fixed-Stackable
Dual Ring
32 Gbps
Switch performance is usually measured by bandwidth = data bus * clock speed and
packet per second it can handle.
Fast Ethernet
Technology Wiring Type
100 m
100 m
100 m
10 km
When both ends dont agree on duplex setting (A is full, and B is half), A will think it can
transmit at any time and wont stop for any reason. However, B might transmit when A will
and cause a collision. It will back off. This causes link and poor response times.
Priority
Ethernet 100BASE-T2
Mode
(full duplex)
Fast Ethernet can use Fast EtherChannel (FEC) feature to allow up to 8 Ethernet links to
act as a single physical link.
100Base-FX uses MT-RJ or SC connector. MT-RJ connector has a tab on top for easy
removal, like RJ-45; it uses 2 fiber-optic strands. SC connector also use 2 strands but the
connector is square in shape.
Some people only install 2 pairs of wires in the UTP 4 cable to lessen their work, but this is
not good for future development or exchange of cables.
Autonegotiation is only allowed in UTP Fast Ethernet and Gigabit Ethernet links. When only
one side is set to auto-negotiate, duplex setting cant be detected, so the port falls back to
half-duplex state.
Fast Ethernet defaults to use full duplex
Gigabit Ethernet
Gigabit Ethernet uses somewhat different physical layer standard, called ANSI X3T11
FibreChannel, which provide a base of high-speed ASICs, optical components, and
encoding/decoding and serialization mechanism.
802.3z
Wiring Type
1000BASE-CX
25 m
1000BASE-T
100 m
1000BASE-SX
275 m
550 m
1
1
1
550 m
550 m
10 km
1000BASE-ZX
1
1
70 km
100 km
802.3ab standard provides Gigabit Ethernet over copper, which allow falling back of 10 and
100 Mbps, and allow autonegotiation as well, of which, 1000Base-T (full-duplex) has the
most priority, followed by 1000Base-T (half-duplex).
Gigabit EtherChannel (GEC) support 2 - 8 Gigabit Ethernet link to act as a single logical
link.
Connections are made using modules, usually GBIC or SFP. GBIC support SC and RJ-45,
while SFP support MJ-RT, LC, and RJ-45. These modules can use:
- 1000Base-SX
- 1000Base-LX/LH
- 1000Base-ZX
- Gigastack (a row of different connector in one module) - 1000Base-T
If UTP 5 cable is used 1, 2, 3, 4, 5, 6, 7, 8 on one end connects 3, 6, 1, 7, 8, 2, 4, 5 on the
other end.
Only 1000Base-T can use 1 Gbps, where other GBIC can operate at 10/100/1000 Mbps
10 Gigabit Ethernet
10 Gigabit Ethernet (802.3ae), or 10GbE, operate only at full duplex. The physical
connectors used are defined at physical media dependent (PMD), which can be:
- LAN PHY: interconnects switches in a campus network, predominantly in core layer
- WAN PHY: interfaces with SONET and SDH in MAN
PMD Type*
Fiber Medium
Max Length
MMF: 50 micron
MMF: 50 micron (2GHz* km modal bandwidth)
MMF: 62.5 micron
66 m
300 m
33 m
SMF: 9 micron
10 km
SMF: 9 micron
40 km
300 m
300 m
10 km
10GBASE-CX4
15 m
S = short
L = long
E = extra-long
C = copper
R = LAN PHY
W = WAN PHY
X = (coding)
WWDM = wide-wavelength division multiplexing
Cisco Catalyst switches support 10GbE PMD in XENPAK, X2, and SFP+ transceiver.
Generally, C2 is smaller than XENPAK, with SFP+ being the smallest; allowing more port
density.
10GbE can also be used in EtherChannel, called 10GEC. For EtherChannel to form, the
same protocol/standard must be used.
Autonegotiation
Priority Ethernet Specification Type of Duplex
1
1000BASE-T
Full duplex
1000BASE-T
Half duplex
100BASE-T2
Full duplex
100BASE-TX
Full duplex
100BASE-T2
Half duplex
100BASE-T4
---
100BASE-TX
Half duplex
10BASE-T
Full duplex
10BASE-T
Half duplex
10Base-T didnt have autonegotiation as part of its standard. However, it generates a pulse
called normal link pulse (NLP) every 16 millisecond on an idle link. This means that when
the link is not busy, 10Base-T sends the signal to keep the link from down. When NLP is not
received within a specified time slot, the link is considered down.
802.3u included autonegotiation and many different functions such as Remote Fault
Indication (detect L1 error) and Next Page Function (information about negotiation process).
802.3u is capable of communicating with dissimilar standards. For instance, it uses Parallel
Detection to make the link compatible with 10Base-T and generate NLP signals. The switch
also generate FLP signal every 2 ms to match with 802.3u devices.
Gigabit Ethernet require that all IEEE 802.3z devices have autonegotiation capability.
Software control of the device can override this function by set port negotiation MOD/PORT
{enable | disable}.
GE autonegotiation for 802.3z include:
- Duplex setting (full duplex only)
- Flow control (optional, ask sender to slow down transmission by sending a frame at
0180.c200.0001 to the transmitter. Sender then places the data in buffer. Note the latency
time. Use set port flowcontrol MOD/PORT)
- Remote fault information (detect L1 error)
Verify with show port capabilities available on CatOS
Switch Port Gigabit Autonegotiation
Setting
NIC Gigabit
Switch Link/NIC Link
Autonegotiation Setting
Enabled
Enabled
Up
Up
Disabled
Disabled
Up
Up
Enabled
Disabled
Down
Up
Disabled
Enabled
Up
Down
AUTO
AUTO
Duplex mismatch.
AUTO
Duplex mismatch.
10 Mbps, Half
duplex
AUTO
10 Mbps, Half
duplex
10 Mbps, Half
duplex
10 Mbps, Half
duplex
No Link
No Link
AUTO
10 Mbps, Half
duplex
10 Mbps, Half
duplex
Summary
Only media or connector meeting the standard is not enough, to be able to use a standard,
you must verify the link from end-to-end.
Ethernet Type
Media Type
10BASE-T
100
10
Manchester
10BASE-FX MMF
MMF
2000
10
Manchester
100BASE-TX
100
100
4B/5B
2000
100
4B/5B
10000
100
4B/5B
1000BASE-SX
MMF
2000
1000
8B/10B
1000BASE-LX
SMF
5000[*]
1000
8B/10B
1000BASE-T
100
1000
PAM 5x5
VLAN
A network with only Layer 2 device is called a flat network topology. A switch provide VLAN
connectivity at Layer 2 of OSI model. A network shouldnt have more than 30 VLANs.
Note that since extended VLAN are not stored in vlan.dat in the Flash, they are not
supported by VTP client or server. This means you must manually delete the VLANs and
reassign the ports when moving from transparent to client or server mode.
By default, all switch port are assigned to VLAN 1, VLAN type is Ethernet, and MTU = 1500
bytes. (VLAN 1 uses default value, and they cant be changed unless the native VLAN is
change) VLAN 1 and 1002 - 1005 are for special purposes.
Extended VLAN can be used for WAN interfaces, L3 Ethernet ports, and sub-interfaces.
VLAN can be dynamically assigned with VMPS, cisco uses applications such as CiscoWorks.
When planning for VLAN, an important factor to consider is relationship between VLAN and
IP subnet; Cisco recommends one IP subnet/VLAN.
However, its possible to have more than 1 IP subnet/VLAN, example, VLAN 1.
A VLAN is active (or passing traffic) by default, however, you can force it into suspension
mode, which means the entire VTP domain wont pass any traffic (as this mode
propagated). (config-vlan)#state suspend only applies to standard range VLANs, you cant
force an extended VLAN to suspend. Status is suspended in show vlan [brief]
On the other hand, if you (config-vlan)#shutdown or (config)#shutdown vlan a VLAN, it
will only be shut on that switch, rather than propagating throughout the domain. The
Status is shown as act/lshut' in show vlan [brief]
In CatOS, #vlan database + (vlan)#vlan 20 name A + (vlan)#apply = (config)#vlan
20 + (config-vlan)#name A + (config-vlan)#exit.
Other options include (vlan)#abort, abandoning current configuration and return to #
mode. (vlan)#reset abandon the current configuration. You can verify with (vlan)#show
{current | proposed | difference}
Cisco Catalyst 6500 series switches support an additional feature called VLAN locking that
allows administrators to provide an extra level of verification when moving ports from one
VLAN to another. This feature, which is enabled via the vlan port provisioning global
configuration command, requires that the VLAN name, NOT number, be entered when a port
is moved from one VLAN to another via the switchport access vlan [VLAN NAME]
interface configuration command.
(config)#spanning-tree extend system-id enable extended system-ID, on by default.
show interface TYPE/NO switchport show how a switch port is configured for trunking and
its status. Operational Mode of static access means no trunk formed.
show interface TYPE/NO trunk display brief info about an interfaces trunk status.
To form a trunk between a DTP-capable device and a DTP-incapable device, you must force
both ports to be trunk by switchport mode trunk. Any other mode will not form a trunk.
This situation occur when switch forms a link with router, or switches between different VTP
domain want to form trunk. Unless you use switchport nonegotiate, DTP is always enabled
by default.
Access
Dynamic Auto
Dynamic Desirable
Trunk
Access
Access
Access
Access
Access
Dynamic Auto
Access
Access
Trunk
Trunk
Dynamic Desirable
Access
Trunk
Trunk
Trunk
Trunk
Access
Trunk
Trunk
Trunk
For old switches, default mode is dynamic desirable. New switches defaults to use dynamic
auto. Confirm with show dtp [interface TYPE MOD/NUM]
DTP also chooses which trunking protocol a trunk link use. ISL is favored if both are
present. DTP sends message every second OR every 30 seconds after trunk formation.
VLAN 1
VLAN 1 contains control plane traffic and user traffic. Control plane traffic such as VTP, CDP
(advertisement every 60 second), and PAgP are tagged with VLAN 1 information and
forwarded across VLAN 1 regardless its been pruned.
sc0 is used for management of switch such as telnet, SNMP, and syslog. Redundant links in
management VLAN eliminate the need for STP as no loop would be created. If there are
redundant links, separate physical connections only supporting management VLAN are
needed. A good design shouldnt place user traffic on the management VLAN.
Broadcast traffic should be less than 20% of overall traffic.
Trunk design
If the links between 2 switches are not trunk, then the 2 switches need to have n links for
n VLANs it has. Trunk is supported in Fast Ethernet and Gigabit Ethernet, and corresponding
EtherChannel links.
Frames traveling trunk links are tagged, while frames traveling access links are not.
End-to-end VLANs, also called campus-wide VLANs, distribute VLAN throughout the
network. End-to-end VLAN are not recommended since broadcast traffic are carried from
one end to the other, creating possibility for broadcast storms.
All users in a VLAN follow the 80/20 rule. Although only 20 percent of the traffic in a VLAN
is expected to cross the network core, this design can allow 100% of traffic within a single
VLAN to cross the core.
Local VLAN is the opposite of end-to-end VLAN. 20% traffic is kept for local while 80% for
the outside.
Trunking protocols
Trunking protocol header is inserted at the egress switch trunk port. Tag is removed at
ingress port.
ISL is a Cisco-proprietary trunking protocol that can be used on Ethernet, Token Ring,
FDDI, and ATM frame by using a Frame Type field. ISL is sometimes called double tagging
for the extra encapsulation. ISL frames cant pass through non-ISL switches and require a
minimum of FastEthernet connection. Header include source MAC address of the device that
added the encapsulation.
Old ISL doesn't support untagged VLAN and extended range VLAN, new version does. Use
multicast address of 0100.0c00.0000 or 0300.0C00.0000
802.1Q, on the other hand, is referred to as single, or internal tagging; it can be used on
Ethernet or Token Ring, as indicated by CFI bit, which is also known as canonical format,
little-endian or big-endian format.
The 4-byte header is added after source address field. The first 2 bytes are used as Tag
Protocol Identifier (TPI) that is always equal to 0x8100 (indicating 802.1Q frames here).
The remaining 2 bytes are used for Tag Control Identifier (TCI). The TCI information
contains a three-bit Priority field, for CoS functions in 802.1Q/802.1p with one bit for CFI.
The last 12 bits are used as a VID to indicate the source VLAN for the frame. The VID can
have values from 0 to 4095, but VLANs 0, 1, and 4095 are reserved.
802.1Q can pass through non-trunking switches due to 802.3ac
Native VLAN is used by the switch to carry specific protocol like VTP, CDP, PAGP, DTP, etc.
Native VLAN between trunks must match (use switchport trunk native vlan command),
CDPv2 carry native VLAN information.
For a trunk to operate, these conditions must be the same: Trunking mode, Trunking
protocol, Native VLAN, if exist, and Allowed VLAN, if configured
A VLAN may be blocked traffic due to:
1) Its not on Allowed VLAN list. If used with VTP pruning VLANs, allowed VLAN list takes
precedence.
2) VLAN is temporarily pruned by VTP, which stops traffic where it isnt possible
3) VLAN doesnt exist, or is not active
4) VLANs STP is not in a Forwarding State
VLANs traveling across a trunk can be reduced by:
- switchport trunk allowed permits only certain VLANs manually, default to allow all. Check
with Allowed VLAN in show int trunk
- Only active VLANs travel across a trunk, check with Allowed and active in show int trunk
- After VTP pruning, rest of VLANs that can travel on the trunk are included in Active and
not pruned list in show int trunk
InterVLAN routing
InterVLAN routing can be done in:
- Physical Router interface: simple and easy to implement (router simply use no shut and
ip address commands). Not scalable, router only has a few physical ports.
- Router sub-interface (router-on-a-stick): scalable (use encapsulation [dot1q | isl] VID +
ip address commands, need native VLAN and trunk links). Bandwidth of a single interface
is shared, thus easy bottleneck as VLANs grow. Single point of failure.
- SVI: recommended. Scalable, redundant, easy to configure. (interface vlan [same VLAN as
that assigned to hosts] + ip address + no shutdown)
Router can configure IP address of 802.1Q native VLAN on its physical interface. This way, a
sub-interface is reduced, so is encapsulation dot1q N native
802.1Q-in-Q tunneling
Traditionally, VLANs cant extend beyond WAN boundary and it isnt really a good design to
do so. However, to connect to remote networks, 802.1Q-in-Q, Ethernet over MPLS
(EoMPLS), Metro Ethernet and VLAN MPLS (VMPLS) can be used to extend VLAN across
WAN links.
Port that provide the tunnel is called a tunnel port, while the customer end uses 802.1Q
trunk (and disable DTP, use switchport nonegotiate dot1q). The link is also called
asymmetric. Always configure one VLAN for each tunnel.
No Layer 3 routing or usage of IP address unless tunnel port is SVI. Cant be configured
with PVLAN, VoIP, fallback bridging, IP ACL, ToS ACL, DTP, .
Traffic including CDP (automatically disabled), STP BPDU (automatically filtered on tunnel
port), VTP, PAgP, EtherChannel, loopback detection and UDLD can pass transparently over
Q-in-Q tunnel.
Frame traffic from these protocols changes its destination MAC address when entering
service provider switch to 0100.0CCD.CDD0, then back to the original MAC address when
the frame is about to enter the client network. If, on the tunnel port, a frame with that
multicast MAC address is received, its shut down to prevent loops.
This tunnel is known as Layer 2 protocol tunnel. By default, its not created to transport
CDP, STP and VTP and all CoS value = 5. There is no default shutdown threshold. This
tunnel cant be created unless both customer and service provider are access ports.
The basic idea of a Q-in-Q or Layer 2 protocol tunnel is that by encapsulating the original
802.1Q frame with another 802.1Q tag (when the frame enters the switch), the switch
strips it off during processing and add it before the frame leaves the switch.
On the switch between service provider and the customer, the switch strips the header
upon incoming frame but dont add it back when the frame leaves the switch. This way, the
outer tag is transparent to the customer network.
Frames from customer network are tagged regardless its already tagged or not.
When serving different customer occupying the same range of VLAN, they will not get
mixed up because the outer tag (customers native VLAN assigned by service provider) is
different.
Also note that the service provider dont have to use the same trunking protocol as the
client, or not trunking at all.
When the native VLAN (from the tunnel port) is untagged, it may get mixed with other
untagged native VLAN from other customers. If the outer tag have the same VLAN ID as the
inner tag, the outer tag is not applied. Solution:
- Use ISL on service provider network
- Tag all native VLANs frames using (config)#vlan dot1q tag native
- Ensure that native VLAN ID on the edge switch trunk port isnt within the customer VLAN
range.
You can increase the system MTU due to the extra tag using (config)#system mtu'
When 802.1Q trunks are used in these core switches, the native VLANs of the 802.1Q
trunks must not match any native VLAN of the nontrunking (tunneling) port on the same
switch because traffic on the native VLAN would not be tagged on the 802.1Q transmitting
trunk port.
PPPoE
PPP is widely used for dial up connection for PtP links. It was designed to work with serial
connections, but it can be encapsulated to work over Ethernet (PPPoE) or ATM (PPPoA).
PPP uses LCP to determine if a link can be established, if so, create a session between a PC
and ISP. LCP packets include fields to make that decision.
PPPoE provide support for DSL, but not for Frame Relay, or other LAN interfaces. PPPoE
use the standard method for encryption, authentication and compression used by PPP.
PPPoE create a virtual point-to-point connection between 2 Ethernet ports using special
software. PPPoE discovery:
1. Initiation: client software send PPPoE active discovery initiation (PADI) to the server to
initiate a connection.
2. Offer: if server accept, it responds with PPPoE active discovery offer (PADO)
3. Request: client send PPPoE active discovery request (PADR) packet to the server
4. Confirmation: server send a PPPoE active discovery session (PADS) packet that includes a
unique ID for the session.
PPPoE works with DHCP to manage the address pool when session is generated/ended.
PPPoE sample configuration:
EdgeRouter(config)# interface fa0/1
EdgeRouter(config-if)# ip address 192.168.100.1 255.255.255.0
EdgeRouter(config-if)# ip nat inside
EdgeRouter(config-if)# pppoe-client dial-pool-number 1
EdgeRouter(config-if)# exit
EdgeRouter(config)# interface dialer1
EdgeRouter(config-if)# mtu 1492
EdgeRouter(config-if)# encapsulation ppp
EdgeRouter(config-if)# ip address negotiated
EdgeRouter(config-if)# ppp authentication chap
EdgeRouter(config-if)# ip nat outside
EdgeRouter(config-if)# dialer pool 1
EdgeRouter(config-if)# dialer-group 1
EdgeRouter(config-if)# exit
EdgeRouter(config)# dialer-list 1 protocol ip permit
EdgeRouter(config)# ip nat inside source list 1 interface dialier1 overload
EdgeRouter(config)# access-list 1 permit 192.168.100.0 0.0.0.255
EdgeRouter(config)# ip route 0.0.0.0 0.0.0.0 dialer1
VTP
VTP messages are send as multicast frames at 0100-0CCC-CCCC, SNAP = AA and type =
0x2003. To clear the configuration version number (to ensure no wipeouts), perform the
following for any new switches introduced regardless of VTP mode.
- Change VTP mode to transparent (transparent mode always have revision number of 0)
then to server
- Change the VTP domain to another name, then back to the current name
Synchronization problem can occur when: 1) link to network using trunk links, 2) new
switch has same VTP domain, 3) higher revision number, or 4) same password.
VTP has 3 versions: v1 (default) doesnt send all necessary updates, v2 is used in switches
with using IOS operating system, and v3 is used in switches using CatOS. VTP v3 allow
extended VLAN to be used and advertised but the version is not available in all IOS Catalyst
switches.
Version 1 and 2 are incompatible. Version 2 offers the following enhancement:
- Support Token Ring
- Perform consistency check on VTP and VLAN parameter to prevent error. No consistency
checks on VTP messages from trunk links, configuration, or database read from NVRAM.
- Switches in VTP version 1 dont relay VTP information to other switches unless the domain
name, and version number match (support multiple domains). For version 2, the update
can be relayed even though the domain or version may not be the same (support single
domain). This also reduce CPU cycles
- Support advertisement of unrecognized TLV messages. Propagate the message and keep a
copy in NVRAM
Switches can start using VTP version 2 if a VTP message with a higher revision number
shows up.
VTP pruning allow efficient bandwidth usage by forward frame (for a VLAN) over a trunk
link only if the receiving switch has ports in that VLAN. VTP pruning uses join messages to
decide whether to forward. This feature is present in both V1 and V2, and is off by default.
vtp pruning has no effect on transparent switches because it can only prune VLANs from
2 to 1001 by default. Pruning in transparent mode must use switchport trunk pruning vlan
command. The command specify which VLANs can be pruned.
Verify with show interface TYPE MOD/NUM switchport
If a switch has no domain name, it will accept the domain that is being propagated to it
first. This means if there are 2 VTP domain, the first VTP update to reach that non-domain
switch will become the VTP domain that that switch. This is dynamic VTP.
VTP can only propagate information for up to 1024 VLANs (use 15 bits); this is why
extended VLANs are not advertised in the VTP domain.
- The management domain length field is used to specify the length of the VTP management
domain, while the management domain name field specifies the actual name of the VTP
management domain.
- The starting advertisement field, or start byte, as it is sometimes referred to, contains the
starting VLAN ID of the first VLAN for which information is requested.
Type field = 1 <==> summary advertisement
Type field = 2 <==> subset advertisement
Type field = 3 <==> advertisement request
Summary advertisement: when vlan.dat changes. Updates every 5 min by client and Ser.
Sequence number (like that in TCP) contain sequence of the packet in the stream of
packets that follow a summary advertisement; start with 1.
Lower VLANs occur before higher ones. Here is the VLAN information field, with 802.10
SAID indicate some security mechanism for Layer 2.
VTP version 3
VTP version 3 is the third version of the VLAN trunk protocol. This version of VTP enhances
its initial functions well beyond the handling of VLANs. VTP version 3 adds a number of
enhancements to VTP version 1 and VTP version 2, which include the following:
Support for a structured and secure VLAN environment (Private VLAN, or PVLAN)
Miscellaneous
A VTP domain should have at least 1 VTP server. Cisco recommends 2 for redundancy.
Errors can be found in show vtp counters command along with statistic information.
show vtp status -> VTP version: 2 means this switch is version 2-capable.
vtp filename allow you to specify where to store VLAN information. By default, this is in
vlan.dat in Flash.
vtp interface TYPE MOD/NUM [only] command is used to specify the name of the
interface providing VTP ID. only allow a singles IP address to be the VTP ID. Confirm at
show vtp status
You can debug with debug sw-vlan vtp {events | packets | pruning | xmit}
CatOS support off mode, which means a switch doesnt participate in VTP.
When using VTP with CatOS, avoid using VLAN 1006 to 1024
VTP information is stored in vlan.dat in Flash for client and server. Transparent mode
store normal-range VLAN in vlan.dat and running-config (NVRAM), while extended range
VLAN are stored in NVRAM only.
EtherChannel
Port channel is name of the bundled logical interface while EtherChannel is the name of the
technology. EtherChannel prevent bridging loops and increase bandwidth by making itself a
single logical link. Note that traffic from a particular source MAC address (or whatever the
load-balance criteria is) always go through the same physical link, whether or not this is a
unicast, multicast, or broadcast frame.
These links can be used on any type of device as long as number of ports are sufficient.
All bundled ports must be in the same configuration such as VLAN, speed, duplex setting,
trunk status, and VTP setting. EtherChannel was primarily designed to operate on ISL.
EtherChannel can have different STP path cost.
Interface configuration applies to the interface on which its configured while port channel
configuration applies to the entire EtherChannel. Because, after the formation of
EtherChannel, a change to individual interface will be affected on every other interface, if
the port channel configuration and interface configuration mismatch, the latter configured
command is used.
EtherChannel can be dynamically established by using either PAgP (multicast 01-00-0C-CCCC-CC, Ethertype 0x0104), or port aggregation protocol (Cisco-proprietary) or LACP
(multicast 01-80-C2-00-00-02, Ethertype 0x8809), or link aggregation control protocol.
PAgP
LACP
On
On
No
Auto
Passive Yes
Desirable Active
Yes
No
No
Yes
PAgP
Neighbors are identified by neighbor ID and port group capability are learned to form
EtherChannel; different device, different device ID.
If any of the port setting is changed on one port, to keep the link active, all ports will
change to that setting to keep EtherChannel operating.
Default mode is Auto. Auto mode will negotiate with another PAgP port only if the port
receives a PAgP packet. This port will not actively send a PAgP packet.
Switches running PAgP can be physical learners or aggregate learners.
Physical learners are switches that learn MAC address using the physical port. The port of
a MAC address would be the name of the physical interface, such as F0/1. It will send
packet to the neighboring switch using the EtherChannel from which it learned the source
address. You should set the method to destination-based distribution.
Aggregate learners are switches that learn MAC address based on the logical port of
EtherChannel. The port would be something like PortChannel 1. Default on current Cisco
switches.
PAgP cant detect learner type, while this must be the same for connection to establish,
you must manually adjust to make sure both switches are using the same learner type.
Management traffic are distributed over all physical interfaces, while PAgP PDU will only
send/receive on interfaces that are up and have PAgP in auto/desirable mode. If the port
channel is trunked, PAgP PDUs are transferred on VLAN with lowest VID or from port that
first come up.
You can verify this with show pagp [CHANNEL_NO] neighbor or show etherchannel
summary. Port forwarding PDU traffic is marked as Pd
More to know: Cisco Virtual Switching System (VSS) is comprised of two physical Catalyst
6500 series switches acting as a single logical switch. In the VSS, one switch is selected as
the active switch while the other is selected as the standby switch. The two switches are
connected together via an EtherChannel, which allows for the sending and receiving of
control packets between them.
Access switches are connected to the VSS using Multichassis EtherChannel (MEC). An MEC is
simply an EtherChannel that spans the two physical Catalyst 6500 switches but terminates
to the single logical VSS. Enhanced PAgP (PAgP+) can be used to allow the Catalyst 6500
switches to communicate via the MEC in the event that the EtherChannel between them
fails, which would result in both switches assuming the active role (dual active), effectively
affecting forwarding of traffic within the switched network.
LACP, 802.3ad
One of the difference is that LACP can automatically create port channels by exchanging
LACP packets between ports. It gathers data about link capability and inform other ports.
Once done, it can match the links to become port channel.
LACP require all links to be full-duplex, half-duplex links are suspended (PAgP allow this).
LACP is a Layer 2, MAC-sublayer protocol.
A port using SPAN will be removed from EtherChannel group.
Links with different STP cost can be used to form EtherChannel.
LACP is composed of collector, distributor, LACP agent, and marker and marker response.
The collector assembles frames from physical link, they can parse marker to it then pass it
to LACP agent, which can also parse a marker.
Distributor transmits outgoing frames. Its responsible fore distribution algorithm. Higherlayer agents, such as LACP agent, instruct the redistribution in the marker packet. The
recipient agent will reply (instruct the distributor to create the marker response) with
marker response packet after successful transmission.
Passive mode will negotiate with another LACP port only if the port receives a LACP packet.
This port will not actively send a LACP packet. The port channel group attaches interface to
EtherChannel bundle. Default mode is passive
Note that if you convert a PAgP EtherChannel to LACP will cause all existing EtherChannel
to reset to default channel mode for new protocol.
After LACP PDUs are exchanged, the switches come to an agreement about each others
settings and decide whether the links can become an aggregation by:
- LACP System Priority: default to 32768. Used along with device MAC address to form
system ID. Configure with (config)#lacp system-priority [1-65535] and show lacp sys-id.
Device with lower priority gets to decide which link are active and which are standby.
- LACP Port Priority: Decide whether link is active or standby. The lower, the better. If tied,
lower MAC address win. Port priority + port number = port identifier. By default, maximum
allowed is 16, 8 active and 8 standby. Use (config-if)#lacp port-priority [1-65535] and
show lacp NO internal
- LACP Administrative Key: automatically. Same administrative key, same port channel
group.
Configuration
All Cisco IOS model currently support both PAgP and LACP. You can tell the router to use
this protocol only with this/these interfaces by (config-if)#channel-protocol [pagp | lacp].
Assign the interface with (config-if)#channel-group NUM mode {active | on | {auto [nonsilent]} | {desirable [non-silent]} | passive}. on, auto [non-silent], and desirable [nonsilent] are use for PAgP, while, on, passive, and active is used for LACP. The NUM must
be between 1 and 64.
By default, PAgP is in silent submode with desirable and auto modes, this is intended to
form EtherChannel with devices that are not EtherChannel-capable, such a file-server or
packet analyzer. No PAgP frames are required to form the connection.
If the other end of the connection is PAgP or LACP capable, then you can add the nonsilent keyword, telling the switch that you expect such a frame for the connection of the
link. If no such frames is heard on the active port, the port remains in the up state, but STP
will shut the port down.
Note that if both devices are using auto silent mode, it would take about 15 seconds for
the connection to establish, and 45 to 50 seconds if both using auto non-silent (30 seconds
come from STP).
If you would like to assign an IP address, you MUST assign it to port-channel interface.
Display Function
Command Syntax
Algorithm
Due to the different load-balancing algorithm, the switch may provide different load to
different links, thus, each link may not have the same work load. When links fail or restore,
balance can be re-achieved very fast and transparent to the user.
Load-balancing in EtherChannel is performed by a hashing algorithm that chooses the
source/destination IP/MAC address, and/or UDP/TCP port information to calculate route to
take.
Depending on the criteria the algorithm chooses to use, for instance, source and
destination IP address, the last 1 bit is XORed if you have a 2-link EtherChannel, the last 2
bits are XORed to calculate a 4-link EtherChannel, and the last 3 bits are XORed for load
balance over 8-link EtherChannel. If a single criteria is used, such as the source MAC
address, only the last 1, 2, or 3 bits will be used.
By default, Catalyst 2970 and 3560 uses source MAC address as the criteria, but if Layer 3
switching is performed, source and destination IP address will be used by default. Here are
the list of options following (config)#port-channel load-balance command:
Port-channel load-balance
Hash Input
Hash Operation
Switch Model
src-ip
Source IP address
bits
All models
dst-ip
Destination IP address
bits
All models
src-dst-ip
All models
src-mac
bits
All models
dst-mac
bits
All models
src-dst-mac
XOR
All models
src-port
bits
6500, 4500
dst-port
bits
6500, 4500
src-dst-port
XOR
6500, 4500
To show the statistics of the load balance, use show etherchannel port-channel or show
etherchannel load-balance command.
EtherChannel guard is a Cisco feature designed to detect EtherChannel misconfiguration. If
a misconfiguration is detected, EtherChannel place the switch interface in Errdisabled state
and print an error message on the console.
By default, this feature is enabled by default and can be disabled by (config)#spanningtree EtherChannel guard misconfig
STP
Spanning-tree protocol is enabled on all Catalyst switches by default. The algorithm
chooses a reference point (which is the root bridge) in the network and calculate all possible
paths to the reference point. If redundant paths are found, some of them are blocked to
prevent loop. When the current active path fails, the redundant links are re-activated.
STP is based on:
- All links are bidirectional and can both send and receive BPDUs
- Every switch is able to regularly receive, process, and send BPDUs
If a port fails, it cant be calculated/participate in STP
802.1d also describes transparent bridging, which is the segmentation of networking into 2
or more collision domain, thus causing less collisions. The process of transparent bridging
contains 5 steps:
- Learning
- Flooding
- Filtering occurs when devices on the same collision of the bridge try to communicate with
each other
- Forwarding
- Aging ensure system only track active devices as a timer keeps note of which device is
active
Type of BDPU
BPDU has source address of the propagating switch and destination address of multicast
01-80-C2-00-00-00. There are 2 types of BPDU,
- Configuration BPDU, are exchanged to elect the root bridge. The election is ongoing and
depend on the BID, which is composed of Bridge priority and MAC address, lower one
wins. STP recalculation only occur when Root Bridge changes
Field Description Protoco Versio
l ID = 0 n = 0
BPDU type =
0x0
Flags
Root Bridge
BID
Cost to Root
Bridge (root port)
No. Of Bytes
No. Of Bytes
By default, no non-root bridge can distribute BPDU. However, a special case can happen in
UplinkFast.
The flags include TC (bit 0, LSB) and TCA (bit 7, MSB) bits, if TC is set, this is a
configuration BPDU in response to a topology change BPDU. If TCA bit is set, this is a
configuration BPDU to acknowledge the receipt of topology change BPDU. TCA BPDU is send
for every TC BPDU.
TC configuration BPDU is re-generated for every switch it passes, and TCA configuration
BPDU is replied by every other switch.
Note: BPDU type = 0 for configuration BPDU, BPDU type = 80 for TCN BPDU
- Topology Change Notification (TCN) BPDU, is for announcing changes in topology, when 1)
port move into forward state (has one designated port), or 2) Forward/learning ->
blocking state.
If PortFast is enabled at a port, STP is disabled.
TCN BPDU doesnt carry data about the change but informs recipients that a change has
occurred. This BPDU is sent from the switch (Root Port) where change take place. Then, the
Root Bridge sends TCN BPDU for a period of (Forward Delay + Max Age =) 35 seconds,
when switches receive this BPDU, it will flush CAM entries inactive for 15 seconds instead of
300 seconds (default). This message include:
Field Description
Protocol ID = 0
Version = 0
No. Of bytes
All switches have a locally configured Hello Time to time TCN BPDU when they are
retransmitted. To change the timer, apply the change on the root bridge; not recommended.
Its better to adjust the diameter of the network, which is, by default, 7 (including root
bridge) switches from root bridge outward.
Port costs
Path cost refers to the cumulative cost to a switch. Root path cost refers to the cumulative
cost needed to reach the root bridge. The cost is incremented at the ingress port. There are
2 sets of standards for 802.1D.
Link Bandwidth
4 Mbps 10 Mbps 16 Mbps 45 Mbps 100 Mbps 155 Mbps 622 Mbps 1 Gbps 10 Gbps
250
100
63
22
10
250
100
62
39
19
14
Every switch always has a copy of the best BPDU. If a better cost comes up, the switch will
choose that as the new path cost.
The above standard uses 16-bit port cost value that can be manually assigned, only used
for ports that haven't been specifically configured for port cost.
802.1t standard uses 32-bit port cost = 200,000,000 / bandwidth (in Mbps). You can
configure to use this with (config)#spanning-tree pathcost method {long | short}.
Remember that lower cost are preferred and by default, 802.1d port cost is used.
A switch has only 1 designated port/segment and 1 root port/non-root bridge. 2 links to
the same segment will cause one to become blocked (unless EtherChannel is implemented),
the blocked port is elected by:
Highest root bridge BID (priority + MAC address)
Highest root path cost (to root bridge)
Highest sender BID (priority + MAC address)
Highest sender port ID (port priority + port number)
Note: EtherChannel ports has, by default, a high port ID, therefore, likely to be elected
blocked.
Port states
When a port first initializes, its in blocking state. Use show spanning-tree interface [TYPE
MOD/NUM] [detail], and debug spanning-tree state commands to verify the state.
STP State The Port Can...
Duration
Disabled
N/A
N/A
Blocking
Receive BPDUs
Listening
Learning
Note: only ports connect to other switches or bridges are considered STP ports
A port moves from blocking to listening if the port thinks it can become forwarding.
Types of STP
Here are some different types of STP:
Type of STP Function
CST
1 instance of STP for all VLANs, election on the native VLAN; 802.1Q-based
PVST
PVST+
Provides interoperability between CST and PVST; operates over both 802.1Q and ISL
STP configuration
General
You can also manually change the cost of a path reaching the root bridge (for all VLANs or
for one VLAN) by (config)#spanning-tree [vlan VID] cost VAL command. Display the cost of
a specific interface by show spanning-tree interface TYPE/NO cost. Only recommended to
change on the Root Bridge to prevent suboptimal switching.
Timers
Port ID
A port ID consist of port priority (8 bits) and port number (8 bits). The priority range from
0 to 240 (in increment of 16) and default to 128, and port number can be found as the last
number of the slash, but its not always this way.
Port ID for Port Channel is always higher than un-bundled ports; Po port are shared port.
All physical links will still participate in STP.
You can find the port ID at show span int TYPE/NO [detail] under Prio.Nbr section, where
PPP.NNN means port_priority.port_number. The priority can be changed by (configif)#spanning-tree [vlan VID] port-priority PRI
There are 2 types of port ID format, 802.1D and 802.1t:
- D: 8 bit of port priority + 8 bit of port number
- T: 4 bit of port priority + 12 bit of port number
Enable PortFast globally by (config)#spanning-tree portfast default or portly by (configif)#spanning-tree portfast to change to Forward state immediately. Having PortFast doesnt
mean STP is disabled, the process will still take 20 seconds instead of 50.
PortFast stops the port from sending TCN BPDU and can be enabled at trunk ports with
(config-if)#spanning-tree portfast trunk. Verify at show spanning-tree summary
UplinkFast is used when you have multiple paths (from the Access switch) to the
distribution layer. Failure of one would cause the other link (called alternate port) to transit
into Forwarding state in 1 to 3 seconds. This feature works on all VLANs for this switch.
This feature is not allowed for the Root Bridge, and change the priority to 49,152 and
increase port cost by 3000 to prevent this switch from becoming Root Bridge.
Enabled with (config)#spanning-tree uplinkfast [max-update-rate PKT_PER_SEC]. Verify
with show spanning-tree [uplinkfast]
As this feature may cause potential loop, the access switch floods dummy frames with
source MAC address in its CAM table (so other switches update their CAM table to hear the
latest news). The frames are send to 01-00-0C-CD-CD-CD so other switches can learn these
address. By default, these frames are send at 150 packets/second (or pps), but you can
change them with max-update-rate parameter. The range is 0 - 65,535, with 0 means no
dummy frames sent.
BackboneFast
BackboneFast provide fast failover for indirect link failure. For instance, you have S1 as
Root Bridge, S2 and S3 are both connected to S1 and to each other. When link between S1
and S2 fails, S2 think its the Root Bridge and send out BPDU to S3.
S3 will ignore the BPDU (the link between S2 and S3 is inactive cuz one port is in Blocking)
until Max Age timer (of BPDU from Root Bridge) expires. S3s Root Port is now in Listening
state and send out BPDU (from Root Bridge) to S2. S2 stops thinking its the Root Bridge
once it hears the better BPDU. This leaves S2 at least 50 seconds of no connectivity.
BackboneFast only works if a bridge detects a direct link failure. The purpose of this
feature is to reduce the Max Age timer as much as possible, thus, reducing STP process by
as much as 20 seconds.
BackboneFast send out a RLQ PDU request (Root Link Query + PDU) to all not-designated
port (Root Port + Blocking port) except the port where inferior BPDU is received. Switches
receiving this message will reply with RLQ response to indicate its alive. If such a reply is
received from the Root Bridge (from the Root Port), then S3 send Root Bridges BPDU to S2
(and move the port connect to S2 to Forwarding). If no such reply is received from Root
Port, then STP converges because Root Bridge cant be heard.
If the inferior BPDU arrives on the Root Port and there are no Blocked ports, the switch will
assume it has lost connectivity with the Root Bridge. Unless it hears a better BPDU, it will
assume itself as the Root Bridge.
Note: RLQ PDU requests are send out S3s Root Port, while RLQ PDU responses are send
back from Designated port. If there is another switch between S3 and S1, and that switch
has confirmed connectivity (Hello BPDUs) to S1, that switch will forward the response back
to S3 without passing it to S1. If there isnt confirmed connectivity, that switch will relay the
frame to S1.
Note: RLQ PDU has same format as configuration BPDU but different SNAP address.
BackboneFast can be configured on every switch regardless of design consideration.
BackboneFast is not available on 802.1D but PVST+.
Configure with (config)#spanning-tree backbonefast, verify show spanning-tree
summary or show spanning-tree backbonefast
Verification
Task
Command Syntax
# show spanning-tree
Find the root bridge ID, the root port, and the root # show spanning-tree [vlan vlan-id] root
path cost.
Additional features
Root Guard
Root Guard prevent a Designated port from becoming a Root port (prevent change of Root
Bridge). This feature is enabled on a port (whose switch doesnt have to be the root bridge)
so that a better configuration BPDU will put the port into a root-inconsistent state, which the
port can only forward BPDU. It cant received BPDU and cant send/receive data for any
VLANs. Once superior BPDU are no longer received, the port cycles through normal STP
state.
This feature should be enabled on all switches in a domain. Its configured by (configif)#spanning-tree guard root. Verify with show spanning-tree inconsistentports command
for error but only show with show run.
Cant be used with BPDU Guard or Loop Guard.
BPDU Guard
Even when PortFast is enabled on a port, STP is disabled, but still can detect loop during
the first 50 seconds or so.
BPDU Guard is used to protect the PortFast port by putting the port into errdisable state
anytime a BPDU is received. The port remains in that state unless 1) shut then no shut, or
2) errdisable recovery cause bpduguard after 300 seconds (validate with show errdisable
recovery and change timer with (config)#errdisable recovery interval TIME).
When the port times out, it returns to forwarding state through normal STP cycle.
By default, BPDU Guard is disabled, to enable it globally, use (config)#spanning-tree
portfast bpduguard default or per-port with (config-if)#spanning-tree bpduguard enable.
BPDU Guard should be enabled on ports with PortFast on. Note that on the switch where
BPDU Guard is enabled, BPDU can be send out, but not received.
Ports connect to hubs should have BPDU Guard on as it may repeat BPDU from another
switch. You should not enable BPDU guard on any switch uplink.
BPDU Filter
If BPDU filter is enabled, the switch port cant send or receive BPDU. Its enabled with
(config)#spanning-tree portfast bpdufilter default or (config-if)#spanning-tree bpdufilter
{enable | disable} command. It doesnt put such a port in Errdisabled state, but it disables
STP on that port (in disabled state), validate with show spanning-tree summary.
Loop Guard
Loop Guard checks Root Ports and Blocked Ports (all non-designated ports), to ensure they
receive BPDU. A port can be brought up (from blocked state) because BPDU is no longer
detected (possibly unidirectional), which will cycle through STP state once Max Age timer for
the current BPDU expires. This would result in a loop.
Loop guard continuously monitor non-designated ports BPDU, if they go missing, the port
is placed into loop-inconsistent state. When BPDUs are received again, the Loop Guard
move through normal states. Loop Guard disable ports on a per-VLAN basis. Loop Guard
should
- Cant be enabled on the same port as Root Guard
- Not affect UplinkFast or BackboneFast
- Be enabled on PtP (full-duplex) links only
- Not be affected by STP timer
- Cant detect unidirectional link (best implemented with UDLD)
- Not be enabled on PortFast or Dynamic VLAN ports.
By default, Loop Guard is disabled. To enable it, use either (config)#spanning-tree
loopguard default or (Config-if)#spanning-tree guard loop. Loop guard can be enabled on
any port without design consideration because it will only monitor the non-designated ports.
UDLD
All our cables are bidirectional, meaning we can both send/receive data. However,
sometimes, the link may become unidirectional, or it can only send data or received data.
This may cause the device on the other end to think its neighbor is no longer present and
chooses to open up the blocking port; this can easily cause a loop to form.
Unidirectional Link Detection (UDLD) solves this problem by monitor a port to see if its
truly unidirectional (if packets are being received on one side only).
A UDLD protocol packet (contain this devices and neighbors port ID) is send to neighbor
switch every 15 seconds (to 01-00-0C-CC-CC-CC), which neighbor should echo back, along
with its acknowledgement (if not, the port is shut down). Link status can be determined
after 3 messages. This takes 45 seconds, or before STP moves another link to forwarding
state. Here are the fields contains in UDLD frame:
Field
Description
Device ID
Port ID
This field contains the module and port number of the sending device.
Echo
This field contains the module and port pair known by the sending device.
Message Interval
Timeout Interval
Device Name
This field contains the CDP Device ID string of the sending device.
Sequence Number
Reserved
Both ends must be configured for UDLD, this means on a link, there are 2 UDLD processes
running simultaneously and independently. UDLD can be enabled on any port without design
consideration. UDLD has 2 modes of operation
- Normal mode: when unidirectional link is detected, port is allowed to continue its
operation. UDLD marks the port as undetermined and generate syslog message.
- Aggressive mode: when no acknowledgement is heard back (even if the message comes
back), switch will try to re-establish connection by sending messages every second for 8
seconds. If no reply is heard, port is placed under errdisable state. You can re-enable such
a port with #udld reset
To configure UDLD, you can enable it per/port by (config-if)#udld {enable | disable |
aggressive}. You can also enable it globally (for all fiber-optic switch ports) with
(config)#udld {enable | aggressive | message time SEC}. Normal mode is enabled with
enable keyword, while message time can range from 7 to 90 seconds.
Loop Guard
UDLD
Configuration
Per-port
Per-port
Action granularity
Per-VLAN
Per-port
Autorecover
Yes
Yes
No
No
Yes
RSTP
When RSTP and STP are compared (without any additional commands), RSTP is better
because its less timer-dependent.
BPDU
RSTP BPDU has the same format as STP BPDU (thus, backward compatible), except its
protocol version identifier = 2.
Another difference is that RSTP utilize all 8 bits (instead of 2) of the flag byte to indicate
different types of BPDU.
Bit 0
TC
Bit 1
Bit 2-3
Bit 4
Proposal
Port Role
Learning
Bit 5
Forwarding
Bit 6
Agreement
Bit 7
TCA
RSTP BPDUs are send from every switch every 2 seconds. Max age is 6 seconds, and
message age is simply used as hop (or switch?) count instead of calculation.
Port
Here are the port states of RSTP
802.1D State
802.1w State
Default Port
Operational Status
Port in Active
Topology?
Disabled
Discarding
Enabled
No
No
Blocking
Discarding
Enabled
No
No
Listening
Discarding
Enabled
Yes
No
Learning
Learning
Enabled
Yes
Yes
Forwarding
Forwarding
Enabled
Yes
Yes
Verify with show spanning-tree vlan command. A type of P2p Peer (STP) indicate a
neighbor running STP. If necessary, you can override link type using (config-if)#spanningtree link-type point-to-point
Sender switch port identify its port role and port state.
Synchronization
Synchronization is the process of determining whether link should be up between 2 ports:
1) Switch A sends a proposal to Switch B from its designated port (which should be either
discarding or learning). The BPDU has proposal bit set and send to Switch B.
2) Switch B enable synchronization (once the BPDU arrives), which puts all non-edge ports
into discarding state to prevent conflict in port roles.
3) If switch B agrees (it moves the port into forwarding state, this is usually a Root Port to
pair with Designated port), it sends back a BPDU with agreement bit set. The port on
Switch A then changes to Forwarding (upon receipt of agreement BPDU).
4) If Switch B doesnt send back an acknowledgement (refuses), that port on B slowly
transition to Forwarding state and use STP logic.
Note: it must be the designated bridge (switch with designated port) that should send the
proposal. If the proposal is send out root/blocked port, designated bridge refuses then it
restart the process by sending a proposal to non-designated bridge.
A proposal is send out when the port is in discarding or listening state only.
If a configuration BPDU is not heard back, switch assumes neighbor to be STP and start
using 802.1D logic.
Topology Change
A topology change in RSTP only occur when a non-edge port move to Forwarding state.
In STP, there is TC and TCA BPDU, whereas in RSTP, there is only TC Configuration BPDU
(no TCA BPDU and no more TCN BPDU) unless a STP bridge exist. In STP, the TCN BPDU is
generated by the switch where topology change and require Root Bridge send out
configuration BPDU with TC bit set.
In RSTP, the switch (where topology change takes place) can send out the TC BPDU. When
this BPDU is sent out, the switch starts a TC timer (by default, 4 seconds), for which it will
send the BPDU during this time. This switch will flush all MAC address except MAC address
of edge ports. In other words, all ports that send out TC BPDU will have its MAC address
flushed.
For switches that receive the TC BPDU, it will flush all MAC address except the one which
BPDU arrived on. It also start a TC timer for when it propagate the TC BPDU.
Verify with show spanning-tree vlan command. A type of P2p Peer (STP) indicate a
neighbor running STP.
Compatibility
By default, 802.1D drops 802.1W frames. This means that the 802.1D will send BPDUs
(thinking its the Root Bridge) because RSTP BPDU cant be processed.
On the other hand, 802.1W switch send out RSTP BPDU (because no RSTP response is
heard) and start the migration delay timer, which is 3 seconds by default; now the port is
said to be in compatibility mode. This means the 802.1W switch will continue to send RSTP
BPDU every 3 seconds and the port can accept any type of BPDU.
When the migration timer ends, 802.1W switch checks the STP type. If STP BPDU has
been received, it will start to use STP BPDU (and logic) instead. Know that the RSTP switch
cant revert back to RSTP. This continue of flow cause the entire switch domain to use STP.
Note: during migration delay timer, 802.1W switch can generate responses to 802.1D BPDU
such as TCN and TCA BPDU.
Note: if the TC timer is active on a Root Port connected to an 802.1D switch and a BPDU
with TCA bit set is received, the TC timer is reset.
MST configuration
Task
Command Syntax
(config-mst)#name MST_NAME
(config-mst)#revision REV_NUM
Location of Service
Local
Remote
Enterprise
modules, can then be sized appropriately and connected, while allowing for future scalability
and expansion. You can divide enterprise campus networks into:
- Switch block: a group of access-layer switches, with their distribution switches
- Core block: the campus networks backbone.
Cisco recommends ECM model, which is comprised of enterprise campus area and
enterprise edge area. These areas are further divided into these modules to provide easy
implementation and allow high availability, scalability, and speed:
- Building/Switching module: contain end-user workstation, phones and AP. Contain accessand distribution layer switches
- Core module: routes traffic ASAP or core layer
- Management module: allow secure management for all devices and hosts. Should have
access to traffic in the core block. Require redundant links.
- Server module: provide application and service to end users and devices. Traffic should be
monitored. Provide redundancy with dual-multihome.
- Service provider edge block: external network services used by the network. Linking with
enterprise edge distribution module.
- Enterprise edge distribution module: aggregate external services at Enterprise edge, which
include external routers or firewalls. This module is further grouped into:
^ Corporate Internet Module: provide internal and external users with Internet access.
Require security devices such as IDS and IPS
^ VPN and Remote Access Module: provide VPN traffic, contain devices such as VPN
^ WAN Module: provide WAN access and use WAN protocol such as ATM or Frame Relay.
^ E-Commerce Module
HSRP
A good design should have the primary gateway also acting as STP Root Bridge.
HSRP allow several default gateway devices to appear using a single IP address, which is
activated by (config-if)#standby GROUP_NO ip IP_ADD [secondary] (if the interface
already has an IP address configured, this must be a different IP address but in the same
subnet); secondary keyword is used if the actual interface address is a secondary address.
All routers that provide redundancy for one default gateway address belong to the same
HSRP group, which can be identified by a number from 0 to 255.
HSRP can be assigned to a VLAN interface (int vlan x) but only 16 is allowed maximumly.
However, every instance of HSRP is locally significant, which means having the same HSRP
identifier in 2 different VLANs create 2 different HSRP instances.
If an ARP would be used, a corresponding MAC address for the HRSP group must exist,
which is 0000.0c07.acXX, where XX is group number in hexadecimal.
You may want to use the switchs physical MAC address as the virtual MAC address for the
HSRP group, (config-if)#standby use-bia. Or, you may want a specific MAC address to
participate in HSRP instead of the default, use (config-if)#standby NO mac-address ADD.
There are 2 versions of HSRP, v1 (Version field = 0) and v2 (version field = 1), with v1
used by default. All routers communicate and establish its presence by sending Hello
messages to 224.0.0.2 UDP port 1985 every 3 seconds. The hold timer is 10 seconds. They
can be manually adjusted by (config-if)#standby GROUP_NO timers [msec] HELLO_TIME
[msec] HOLD_TIME. You can use the optional msec keyword if you wish to specify the time
in milliseconds.
HSRP election
The election is based on highest priority, value range from 0 to 255, with 100 being the
default; if priority is tied, highest IP address wins. You can adjust the priority with (configif)#standby GROUP_NO priority PRI.
One router is elected the primary, or active HSRP router; another as the standby HSRP
router; rest routers remain in listen HSRP state.
The standby router monitors Hello message from primary router, if no Hello messages are
received within the hold timer, the primary router is declared down.
Standby router then takes primary routers place, and a new standby router is elected
from the list of routers in Listening state. No new active router can be elected until the
current active router fails unless preemption is configured.
Note that the first router starting up will become the active router (initially no router is
active) even if it doesnt have the highest priority. To challenge the current router (even if it
doesnt have the highest priority), use (config-if)#standby GROUP_NO preempt [delay
[minimum SEC] [reload SEC]]. By default, this command is disabled, once enabled, a local
router immediately preempt if it has a higher priority (without optional configuration).
- minimum keyword to force the router to wait for seconds (0 to 3600 seconds) before
attempting to overthrow an active router. This time begins as soon as the router is capable
of assuming the active role, or after the router is up and HSRP is configured.
- reload keyword to force the router to wait (after it becomes the active router) for seconds
(0 to 3600 seconds) after it has been reloaded. During this period of time, the router will
gather routing protocol information in order to route.
Preemption doesnt mean STP topology also change.
HSRP messages
There are 3 types of messages used:
- Hello: send to 224.0.0.2 by every router to indicate its status, such as Group ID, HSRP
timer values, version, and authentication.
- Coup: send when a router wants to preempt or would like to become the active gateway
- Resign: send by the current active gateway when it resigns its role. Could be due to a
shutdown or hearing better Hello or Coup preemption.
HSRP states
There are 6 stages a router passes in HSRP,
1) Disabled: router not participating in HSRP
HSRP authentication
HSRP ignores unauthenticated HSRP message and by default, Cisco devices use a plaintext authentication of cisco. You can change the password to another plain-text password
with (config-if)#standby GROUP_NO authentication text PASS
You can configure MD5 passwords with (config-if)#standby GROUP_NO authentication
md5 key-string [0 | 7] PASS [timeout SEC], where password should be at least 16
characters (recommended) but less than 64 characters.
You can also use a key-chain instead with (config-if)#standby GROUP_NO authentication
md5 key-chain NAME where the key chain has to be previously configured.
If 0 is used, this is equivalent to standby authentication command, if 7 is used, this
password will be encrypted if service password-encryption is enabled. As for the key chain
configuration, you can use key-string [0 | 7] when specifying it.
When this command is set, clear-text password become 0 indicating its disabled.
Timeout value is the time when the password will become invalid.
Interface track
HRSP has a special feature which it can de-prefer a router if its interface fails. The
purpose of HRSP is to deliver data reliably, if a router has outgoing interface down, it cant
deliver the data and thus, not reliable.
You can track a certain interface with (config-if)#standby GROUP_NO track TYPE MOD/
NUM [DECRE-VALUE], where the TYPE MOD/NUM specify the interface you would like to
track. For instance, you have enabled HRSP 2 in Fa 0/0 but would like to track S 0/0/0, so
you configure standby 2 track S 0/0/0 in Fa0/0 configuration mode.
DECRE-VALUE is used to make a router unfavorable if the monitoring (Tracking) interface
is down. By default, this is 10. This means 10 is taken away from the router priority if S
0/0/0 is down, and regained when S 0/0/0 is up. The only way a router can resume its role
after interface failure is standby preempt.
HRSP load-balance
Its not possible to load balance traffic across 2 HRSP routers with a single HRSP group,
the solution is using 2 HRSP group, one for each HRSP router as the active router. Users are
evenly distributed across the group to load balance traffic so each half of devices uses one
of the routers as default gateway.
However, this increases the amount of work on the CPU. One solution is to use client/slave
groups. These group follow the master group without participate in the HSRP election.
Therefore, dont need to exchange many messages. However, they do send refresh
messages to keep their MAC address. Use (config-if)#standby MASTER name NAME and
(config-if)#standby SLAVE follow NAME.
VRRP
Very similar to HSRP, but here are the differences:
- Active router is known as virtual master router (highest priority), other routers are backup
virtual routers.
- Default to use VRRP version 2, no version 1. Version 3 (for both IPv4 and IPv6) hasn't
been verified yet.
- Group number from 0 to 255; priority range from 1 to 254
- Add description with (config-if)#vrrp NO description STUFF
- Load-balance like HSRP, using multiple groups.
- Virtual MAC address of 0000.5e00.01XX, XX is the group number in hexadecimal.
- Default to preempt, disable with (config-if)#no vrrp NO preempt
- Tracking with SLA. First configure SLA, then use vrrp NO track SLA_NO. Confirm with
show track [NO] [brief] [interface] [ip] [resolution] [timers] command.
- No authentication by default, can authenticate with plain text or MD5.
- No usage of BIA or static MAC address as virtual MAC address.
- Advertisement in 1-second interval to 224.0.0.18 by master virtual router only, IP protocol
number = 112; backup routers optionally learned from this ad
Task
Command Syntax
Alter the advertisement timer (default 1 second). vrrp group timers [advertise [msec] interval]
Learn advertisement interval from master router vrrp group timers learn
Change the preempt delay (default 0 seconds).
GLBP
In HRSP and VRRP load-balancing, the hosts must be statically (partial) assigned to the
switch ports. GLBP is a Cisco-proprietary protocol using to solve this issue. GLBP operates at
224.0.0.102, using UDP port 3222.
In GLBP, all switches assigned to the same group can participate and offer load balancing
by forwarding a portion of the overall traffic. All hosts use the same gateway address (same
virtual router IP address), but when issuing an ARP, only the virtual MAC address of a
selected router is returned.
Group number range from 0 to 1023
Router priority range from 1 to 255, default 100 (config-if)#glbp GROUP_NO priority PRI
Default to not to preempt, with a delay of 30 seconds -> (config-if)#glbp GROUP_NO
preempt [delay minimum SEC]
To enable GLBP, use (config-if)#glbp GROUP_NO ip IP_ADD [secondary]. Its optional to
configure this on backup routers, but this MUST be configured on the AVG.
Hello messages are send by every router to ensure its presence, Hello default 3 seconds,
Hold default 10 seconds. Configured with (config-if)#glbp GROUP_NO timers [msec] HELLO
[msec] HOLD. You can configure this on AVG only since it advertise this to its peers.
Display with show glbp [GROUP_NO] [brief]
You can configure the AVG to store a database of host using the default gateway and other
information at the client cache using glbp client-cache command and verify with show blip
detail command.
Weighting feature
GLBP uses a weighting function to determine which router becomes the owner of the new
AVF. Each router begin with a maximum weight value (range from 1 to 254, default 100),
when tracked interfaces go down, the weight decrease and increase when the interface
come back. Secondary AVF can become AVF once current AVF fall below the threshold for 30
seconds. If there is no tracked interface, maximum weight value dont change.
Tracked interface can be configured by (config)#track OBJ_NO interface TYPE MOD/NUM
{line-protocol | ip routing}, which the interface can be tracked based on line protocol status
or up interface + enable routing + valid IP address). OBJ_NO can range from 1 to 500.
There is a physical range, or threshold, of the routers weight to be qualified for an AVF.
This range is established by lower bound (default 1) and upper bound (default 100). The
router with the highest weight (in the threshold range) becomes the new AVF.
This utilize the command (config-if)#glbp GROUP_NO weighting MAX [lower LOWER]
[upper UPPER]. MAX is the maximum weight value, which is the initial weight value
assigned to a router.
The rate at which the weight decrements by (config-if)#glbp GROUP_NO weighting track
OBJ_NO [decrement VAL]; default is 10.
Load-balance algorithm
The AVG assign virtual MAC address using one of the following methods:
- Round robin Each new ARP request for the virtual router address receives the next
available AVF. Traffic load is distributed evenly across all routers, assuming that each of
the clients sends and receives the same amount of traffic. This is the default method used
by GLBP.
- Weighted weighting value determines the proportion of traffic that should be sent to
that AVF. A higher weighting results in more frequent ARP replies containing the virtual
MAC address of that router. If interface tracking is not configured, the maximum weighting
value configured is used to set the relative proportions among AVFs.
- Host dependent Each client that generates an ARP request for the virtual router
address always receives the same virtual MAC address in reply. This method is used if the
clients have a need for a consistent gateway MAC address.
Use (config-if)#glbp GROUP_NO load-balancing {round-robin | weighted | host-dependent]
IP phone
An IP phone can obtain its power source from:
- external AC adapter
- PoE over UTP, power source is switch
A switch keep its power disabled if the switchport is down. However, the switch
continuously try to detect if a powered device is connected to a port. If it is, the switch must
begin providing power to that device. Then Ethernet link to that port is established.
Notes
15.4 W
Default class
4.0 W
Optional class
7.0 W
Optional class
15.4 W
Optional class
Up to 50 W
Class 0 is used to indicate that neither the switch nor the powered device support/attempt
PoE. Class 4 is also used for 802.3at, also known as PoE Plus.
Detection of power using ILP: send out 340 KHz test tone on transmit pair of Ethernet
cable to detect whether the connected device is inline power capable. If connected device is,
the test tone is looped back. ILP-capable device loops the transmit and receive pair while its
powered off.
By default, switches try to detect and offer inline power in auto mode, but this can be
changed by (config-if)#power inline {auto [max MILLI_WATT] | static [max MILLI_WATT] |
never}, where MILLI_WATT is the default power offered.
Verify with show power inline [TYPE MOD/NUM], under Class if 0 - 4 is used, this
indicated device is used 802.3af and one the power class. If n/a is used, this device is used
ILP.
QoS
Packets doesnt effect how QoS is handled, it just show what requirement it would like to
have for it to travel in the network.
When a frame is send from one host to another, 3 basic things can happen:
- Delay caused by time required to send the packet (physical, switching, routing); the time
takes for a packet to travel from start to finish is measured in latency
- Jitter is caused by variation occurred in latency so that packets dont all arrive at
predictable time.
- Loss is caused by the missing of packets due to congestion or error; use connectionoriented protocol
To address and alleviate these conditions, a network can employ 3 basic types of QoS:
- Best-effort delivery, used by default, no QoS
- Integrated services model, or (IntServ) uses RSVP (RFC 1633) to arrange a path for
priority data from source to destination. Source application send a packet with QoS
parameter through RSVP, each device on the path check if it meets the minimum
requirement for the application. If yes, special packet is send to the source to inform this,
then the source begin sending.
- Differentiated services model (DiffServ) is IntServ at large. Each network device handle
packets on an individual basis by applying different policies for different packets. QoS is
handled dynamically, in per-hop basis (IntServ uses per-flow basis). Most popular.
Note: for QoS to be effective, all devices from the sender to the receiver must implement
the same QoS policy.
DSCP (6 Bits)
Name
Value
Routine
Default
Default
Priority
AF
1: Low
AF11
2: Medium
AF12
3: High
AF13
1: Low
AF21
2: Medium
AF22
3: High
AF23
Immediate
10
AF
Flash
Flash Override
11
100
AF
AF
EF
1: Low
AF31
2: Medium
AF32
3: High
AF33
1: Low
AF41
2: Medium
AF42
3: High
AF43
EF
Critical
101
Internetwork Control
110
(4855)
Network Control
111
(5663)
DS is backward-compatible with ToS, so non-DiffServ devices can forward the packet using
ToS only. DS and ToS occupy the same space, they differ in the way their value differ.
The first 3 bits, DS5 to DS3, specify one of 8 classes (DSCP defaults to 0):
- Class 0, default class, best-effort forwarding
- Class 1 - 4, or assured forwarding (AF) service level. Higher number = higher priority.
Lower priority packets may be dropped
- Class 5 or expedited forwarding (EF) service offer premium service. Least likely to be
dropped, for time-critical data
- Class 6 (internetwork control) and 7 (network control) area used for network control traffic
such as STP and routing protocol.
3 bits for IP precedence or drop precedence is contained in DS2 to DS0. Value range from
1 (low) to 3 (high). The higher the value, the more likely to be dropped. Factor to decide
whether or not to drop a packet.
1- Classification is used to identify which level of service each packet should receive. Each
packet can be classified based on many things, e.g L4 protocol, ACL, etc. There are 4 types
of classification:
- Untrusted: incoming frame lose its CoS value and inherit default value (0 for Catalyst 6500
by default) assigned by the device.
- Trusted-cos: incoming frame retain CoS value
- Trusted-dscp: incoming frame retain its DSCP value
- Trusted-ipprec: incoming frame retain its IP precedence value.
By default, a network should be able to trust QoS parameters assigned by network devices
(such as router, switch, and IP Phone) within the trust boundary. A trust boundary is the
endpoint of an extend of a network (such as access-layer switch and demarc points). End
users such as PCs are not trusted.
2- Scheduling is used to determine if a packet is dropped. The buffer holding the queue
(where packet is placed) can hold a certain amount of packets (hardware-dependent) before
extra packets get dropped.
Different CoS values can be mapped with different drop threshold value so it will be
discarded if the queue reaches that amount. For instance CoS 0 mapped to threshold one
that is set to 50% will drop any CoS 0 packets if the queue if 50% or more occupied. This
mapping can be found with show qos infor config MODULE rx'
3- Marking and policing at the switch engine or PFC/PFC2 using 1) DSCP or IP precedence of
packet, 2) CoS value from frame, or 3) user-defined access list.
The packet can get dropped or marked with a lower priority if bandwidth is limited. Switch
can determine this by looking at a flow (microflow) or lots of packets (aggregate). On
Catalyst 6500, 63 microflows can be simultaneously supported. Aggregate support up to
1023 policing configuration.
4- Marking means the switch will return the CoS or ToS value the frame originally have at
the egress port.
5- Output scheduling determines how and when the frame gets send out due to different
queue value and size as well as threshold map.
Configuration
An upstream switch can instruct IP phone to extend QoS trust by CDP messages. To
enable QoS on the switch, use (config)#mls qos'. By default QoS is disabled and all QoS
information is allowed to pass from one switch to another. Enable QoS configures all switch
ports as untrusted, by default.
Define QoS parameter by (config-if)#mls qos trust {cos | ip-precedence | dscp}, its
recommended to configured cos for port connected to the IP Phone.
(config-if)#mls qos trust device cisco-phone allow the port to be trusted only if CDP
detects a Cisco phone connected. If not, port is untrusted.
(config-if)#switchport priority extend {cos VAL | trust}, if the trust keyword is used,
host connected to IP phone is trusted, in other words, its CoS value is unchanged. If cos
keyword is used instead, it defines the CoS value a packet should be overwritten with (by
the IP phone). By default, overwritten CoS is 0.
(config-if)#mls qos trust cos configures the switch to unconditionally trust packets
coming into the port.
By default, Cisco switch uses a CoS-to-DSCP mapping to convert inbound CoS values to
DSCP values since CoS MUST be converted to DSCP or IP precedence.
Auto-QoS is a macro command that allow you to easily configure QoS; recommended to
use on default configuration as current QoS configuration may be overwritten. Auto-QoS
handles:
- Enable QoS
- CoS-to-DSCP mapping for QoS marking
- Ingress and Egress queue tuning
- Strict priority queues for egress voice traffic
- Establishing an interface QoS trust boundary
Auto-QoS can be configured with (config-if)#auto qos voip {cisco-phone | cisco-softphone
| trust}. cisco-phone is for IP phone, cisco-softphone is for PC running SoftPhone
application, packets with DSCP = 24, 26, or 46 is trusted while other values are override to
0. trust allow the device connected to this link to be unconditionally trusted.
Wireless
Ethernet frames are expected to be received within an expected amount of time, thus,
both half and full duplex cables must be the same length.
Distributed system refer to interconnection between APs of multiple cells. There are 3
types of DS:
- Integrated: composed of a BSS network, therefore, no connection
- Wired: different APs are linked by physical cables, usually to Ethernet switches
- Wireless: different APs are linked wirelessly.
AP Basics
For a client to form a membership with the AP (called association), the client has to match
one or more of the following criteria: 1) SSID, 2) wireless data rate, 3) authentication
credentials.
The client sends an association request message, and the AP grants or denies the request
(based on the criteria needed) by sending an association reply message.
An APs coverage area by its antenna is called a cell. When cell sizes are smaller than
average (for higher throughput), they are often called microcells. This concept can be
further utilized to form picocells (minimize AP power and cell size but increase throughput).
When a client associates with one AP, it can freely move about its range. As the client
moves from one APs cell into another (given that both APs have the same SSID), the
clients association is also passed from one AP to another.
Moving from one AP to another is called roaming. If the client maintains its same IP subnet
as it roams between APs, it undergoes layer 2 roaming. If the client roams between APs
located in different IP subnets, it undergoes Layer 3 roaming.
In an ESS, the APs doesnt have to connect to the same switch for roaming. However, it
does require you to be in the same mobility domain.
AP that can be standalone or autonomous within the larger network is called autonomous
mode AP. Each autonomous AP has its own security policies and set of rules, configuration
may differ on different APs and central management (such as monitoring and QoS, etc) is
difficult.
AP act as a translational bridge, where frames from 2 dissimilar media area translated and
then bridged at Layer 2. In other words, AP is in charge of mapping of a VLAN to an SSID.
In case of multiple VLANs, you need the same amount of SSID, connecting to a different
different SSID means connecting to a different VLAN. In this case, the AP connects to switch
using trunk link.
An AP can uplink into an Ethernet network because it has both wireless and wired
capability. AP form mesh topology.
Its not possible to form a one-way communication path between AP and client, which the
client can hear the AP but AP cant hear the client or vice versa.
An AP can form a single wireless link from one LAN to another over a long distance. In that
case, an AP is needed on each end of the wireless link. AP-to-AP or line-of-sight links are
commonly used for connectivity between buildings or between cities.
APs can be daisy-chained to provide coverage for a big area.
802.11 Basics
802.11 WLAN only use half duplex. Transmitting and receiving stations use the same
frequency (channel) so only one channel can transmit any time. For full-duplex to happen,
all transmitting should occur in one frequency while receiving in another.
This is possible, but not yet standardized by 802.11.
Wireless receiver always transmit an acknowledgment to the transmitter to ensure the
transmitter that frame is error-free. If not received within the retransmit timer, frame is retransmitted.
802.11 uses CSMA/CA, which require all stations to listen before they transmit a frame.
When a frame needs to be send, there are 2 possible situations:
- No other device is transmitting: so this station send its frame immediately.
Acknowledgement must be received to verify frame is collision-free.
- Another device is transmitting: this station wait until the frame in progress is complete;
then it must wait for a random period of time before transmitting its own frame.
The entire process of collision avoidance is separated into distributed coordination function
(DCF) and point coordination function (PCF).
DCF is composed of interframe space and random backoff time, with interframe space
further separated into SIFS (management frame, between data frame and its
acknowledgement) and DIFS (data frame for new transmission).
A station must wait for the frame to finish transmitting + random backoff time before it
can transmit; the total time is called SIFS or DIFS.
PCF is the optional process that can be used by the AP to send Contention-free poll packet
to each station to give them access to the data transmission. Capable of providing limited
QoS.
PIFS is used to gain access to the medium before any other STA. The PCF-enabled AP
waits for PIFS duration before it occupies the wireless medium; DIFS > PIFS > SIFS.
Channel access in PCF mode is centralized while it is distributed between STAs in DCF mode.
The PCF is located directly above DCF.
802.11 frames
A wireless frame is composed of 32-byte MAC header, body length ranging from 0 to 2312
bytes, and 4 byte FCS trailer. The 32-byte header is composed of:
- Frame control field (2 byte): information that define the frame such as fragmentation and
encryption.
- Duration/ID field (2 byte): contain transmission time used for CSMA/CA
- Sequence control field (2 byte): contain sequence number and fragment number
- Four address (24 byte): which are Source address, Destination address, Receiver address,
Transmitter address, and BSS Identifier (BSSID)
- QoS (2 byte): CUWNA support WMM
Wireless standard have a hidden node problem which the stations can reach APs but cant
see each other, therefore, creating possible collision when both stations transmit. IEEE
introduced Virtual Carrier Sense to solve this problem, which uses ready to send (RTS) and
clear to send (CTS).
Station A will send a RTS frame which include the source, destination and transmission
time. Station A will only transmit the frame when the AP replied with CTS message, which
contains the duration information. All other stations that receive the CTS set their virtual
carrier sense, also known as network allocation vector (NAV) to not send frames for the
duration specified in CTS.
802.11 management frames:
- Beacon frame: announce existence of AP or if using IBSS, peers
- Probe Request frame: generated by clients seeking
- Probe Response frame: perform same function as beacon frame, just as response to probe
request frame
- Association Request frame: generated by clients asking for association
- Association Response frame: reply to association request frame as successful or rejected
- Disassociation Request frame: generated by clients when it wants to shut down association
- Re-association Request frame
- Re-association Response frame
- Authentication Request frame: after association but before upper layer authentication.
Generated by client
- Authentication Response frame: reply to authentication request
- De-authentication frame: generated by client when it wishes to terminate the secure
session.
CUWNA splits the task of an autonomous AP into lightweight access point (LAP) for
individual function (hardware-based) and wireless LAN controller (WLC) for centralized
function. This structure is also known as split-MAC structure.
LAP can be distributed over several WLC for load balancing or redundancy purpose
WLC Function (automated)
RF Transmit/Receive
MAC management
Encryption/Decryption
Cisco wireless control system (WCS) is an optional server platform that can be used as a
single GUI to manage all WLCs in a network. You can perform additional function and more
centralized administrative function such as monitoring and tracking.
Bootstrap process for LAP:
1. Obtain IP address from a DHCP server
2. Learn IP addresses of WLCs using a DHCP server (option 43)
3. Send a Join request to first WLC in its list of WLC. If that fails, try next until one WLC
accept the join request and reply, binding the 2 devices
4. WLC compares LAPs code image release to code release stored locally. If differ, LAP
downloads code image on WLC and reboot
5. WLC and LAP build 2 tunnels between them, one (secure) for management traffic, and
(non-secure) another one for wireless client data.
Note: each LAP can have at least 1 to 3 WLCs. At first, each WLC address is tried, if none
replies, use broadcast message. When LAP fails to reach its current WLC, LAP reboots and
begin searching WLC again. This means any client association is dropped.
Cisco Hybrid Remote Edge Access Point (HREAP) is a special case for remote sites where
the LAPs are separated from the WLC by a WAN link. With HREAP, the remote LAPs can keep
operating even while the WAN link is down and their WLC is not available, much like an
autonomous AP would do. This allows wireless users to keep communicating within the
remote site until the link (and WLC) is restored.
LAP can be in the same subnet as WLC (easier management), but they dont have to be. A
tunnel is needed to forward the data between the 2 (as they are usually separated by a
switch).
The tunneling mechanism is either lightweight access point protocol, or LWAPP (Ciscoproprietary use UDP ports 12222 and 12223) or provisioning wireless access point protocol,
or CAPWAP (RFC 4118, use UDP port 5246 and 5247). Each of these protocol consist of 2
tunnels:
- Control message: configure LAP and manage its operation. Authentication and encrypted
so LAP is securely controlled by only the WLC
- Data: packets to and from wireless clients associated with the LAP. Data is encapsulated
with LWAPP or CAPWAP but not secured between LAP and WLC.
Each device is authenticated with X.509 certificate to prevent rogue AP.
Autonomous AP
LAP +WLC
CUWNA roaming
Roaming is handled in WLC so that client roaming becomes faster and easier as client
association is managed in a central location via tunnel.
Intra-controller roam refers to user moving from one AP to another, both APs connected to
the same WLC. This is simple as WLC simply updates its table and move the client. Layer 2
roaming
Inter-controller roam refers to use moving from one AP or another, both AP connect to
different WLC. If both WLCs are in the same subnet, association exchange can be easily
established by sending a mobility message exchanging client information. Layer 2 roaming
If 2 WLCs are located on different subnet (different VLAN) and the client roam without
changing its IP address. The original WLC (where the client used to reside) is now known as
anchor WLC and establish a Ether-IP tunnel with the current WLC (called foreign WLC due to
different IP subnet) the client is associated with.
Traffic generated by the host can send out from the foreign WLC, but traffic for the host is
received at the anchor WLC, which send the data over to the foreign WLC via Ether-IP
tunnel built using IP protocol 97. This data is encapsulated at anchor WLC and decapsulated
at foreign WLC so host see the data as if its received on the foreign WLC. Layer 2 roaming
WLCs are configured into logical mobility group to hand off a clients association
information. Client must roam between WLCs in the same logical mobility group to keep its
IP address. A logical mobility group can have up to 24 WLCs.
Layer 3 roaming, or change of IP address, will occur when client roam between different
logical mobility group. The hosts IP address and all session information will be dropped.
Intra-controller
Same WLC
Inter-controller
Different WLC
Inter-mobility
Different WLC
Intramobility
Different WLC
Same mobility group Same mobility group Same mobility group Different mobility group
Layer 2 roaming
Layer 2 roaming
Layer 2 roaming
Layer 3 roaming
Switch configuration
To configure autonomous AP (usually located in access-layer), you can apply PortFast here
and allow the VLANs needed to pass through.
LAP, should be located in access-layer and connect to the VLAN, which it obtains its IP
address to reach the WLC (DHCP server). Its recommended to use a special VLAN for LAP
management. LAP and WLC doesnt have to be connected with a Layer 2 VLAN or trunk link.
PortFast can also be applied.
WLC should be located in distribution layer. If you are using EtherChannel, remember that
WLC cant negotiate so the EtherChannel should be manually configured on.
When providing DHCP service, you should have a DHCP pool on the switch or MLS, with
(dhcp-config)#option 43 ascii WLC_ADD_LIST command.
Security
Here are some tips about securing your switch:
Configure secure password
Use system banner
Secure the web interface (apply ACL with ip http access-class ACL_NO)
Secure switch console
Secure virtual terminal access
Use SSH whenever possible
Secure unused switch ports (switchport host is a macro that put the port into access
mode, enable PortFast, and disable channel group)
- Secure STP operation (by enable BPDU guard, loop guard, and root guard)
- Secure the use of CDP (disable CDP on ports not connect to secure devices)
- Secure SNMP by disable read-write SNMP access by snmp-server community STR RW
-
Port Security
Switch can implement security control using port security. A switch port can allow a
maximum of 1024 MAC address. When the maximum MAC address is exceeded, a syslog
message appears but the interface stays up.
Port security protects against MAC spoofing attack and CAM table overflow attack.
If an interface is undergoing the restrict or protect port-security condition, you may need
to clear the learned MAC address so that a specific host can use the switch port. #clear
port-security dynamic [address MAC_ADD | interface TYPE MOD/NUM].
Interface in shutdown mode are put into err-disabled state when maximum MAC address
exceeds. When a port is shut down, you can
1. Manually enable it with shutdown then no shutdown
2. Configure automatic enable with (config)#errdisable recovery cause [all | CAUSE_NAME]
Static secure address are always in the MAC address table by default.
Dynamic secure address are stored in the MAC address table and are removed when
switch is reloaded or shut down. Configured by (config-if)#switchport port-security
maximum N command
Sticky secure address can be either stored in MAC address table or NVRAM and remain
when switch reloads or power down. They can be found with show running-config
(config-if)#switchport port-security mac-address xxxx.xxxx.xxxx [vlan {VID | access |
voice}] configures a static MAC address, a static MAC address for a certain VLAN, and static
MAC address for access or voice VLAN connected to IP Phone.
By default, secure MAC address (except dynamic) will remain in MAC address table forever,
you can change the infinite timer by (config-if)#switchport port-security aging {static |
time TIME} -> configure all entries in the MAC address table to be flushed after some TIME
(0 means no flushing, default) and static means static MAC address will also be aged.
Verify with show port-security interface TYPE MOD/NUM and show port-security address
(config-if)#switchport port-security aging type {absolute | inactivity} defines how the
timer is applied. If you use absolute, all and any entries will be flushed regardless of type
when the timer (configured using above command) is finished. If inactivity is used, the
TIME is the timer from when an entry expires. show port-security address will have (I) next
to time in Remaining Age section.
DHCP snooping
Attacker can use spoofed DHCP server to obtain user information (specifically its MAC
address) when user forwards DHCP broadcast (at FFFF:FFFF:FFFF) to the spoofed server.
This can easily form a man-in-the-middle attack because the client will now send its data
through the router/DNS server/WINS server etc. Specified by the spoofed DHCP server.
DHCP starvation work with MAC address spoofing by flooding a large number of DHCP
request with randomly generated MAC addresses, thereby exhaust the address space
available thus prevent legitimate client from obtaining legitimate address.
Then spoofed DHCP server misdirect the clients and obtain legitimate data.
To prevent this type of attack, you can enforce security with 1) port security, DHCP
snooping and VLAN ACL.
DHCP snooping categorize switch ports as trusted or untrusted; trusted port can transfer
traffic without any checks; trusted ports should be where DHCP server resides. DHCP
snooping keep track of complete DHCP bindings (from those legitimate replies).
Any DHCP replies coming from (DHCP snooping check inbound traffic only) an untrusted
port are discarded because they must have come from a rogue DHCP server. In addition, the
offending switch port automatically is shut down in the Errdisable state.
(config)#ip dhcp snooping enable DHCP snooping globally, and (config)#ip dhcp snooping
vlan VID_RANGE specify which VLAN to enable.
By default, all ports are untrusted. To configure a port as trusted (or where DHCP server
reside), use (config-if)#ip dhcp snooping trust command. This also means that all DHCP
DISCOVER messages are forwarded to this port.
By default, untrusted ports can receive unlimit amount of DHCP request is accepted. To
limit the rate of DHCP traffic, use (config-if)#ip dhcp snooping limit rate VAL, where VAL
can range from 1 to 2048 DHCP packets per second.
Verify with show ip dhcp snooping [binding]
DHCP option-82, the DHCP Relay Agent Information option, is described in RFC 3046.
When an untrusted port send DHCP DISCOVER message, the switch adds its own MAC
address and switch port identifier into the option-82 field of the request to make the DHCP
server think that its assigning address to legitimate host.
DHCP reply messages are verified to have received on trusted ports, and comparing the
option-82 field, the switch can create a mapping of what MAC address is assigned which IP
address, this is stored in DHCP snooping database. This feature is enabled by default and
can be disabled by (config)#no ip dhcp snooping information option
When configuring DHCP snooping, these commands are not available:
(config)#ip dhcp relay information check
(config)#ip dhcp relay information information policy {drop | keep | replace}
(config)#ip dhcp relay information trust-all
(config)#ip dhcp relay information trusted
An ARP spoofing fools the switch by sending ARP replies before the real host does. This
way, all traffic to the real host goes to the attacker. Cisco created dynamic ARP inspection
(DAI) to deal with it.
Each switch port can be classified as trusted or untrusted. Inspection is performed inbound
only on untrusted port but not on trusted ports. When frames arrive from untrusted ports,
source MAC and IP address are checked statically (ACL) or dynamic (based on DHCP
snooping database), if dont pass the test, the packets are dropped.
Dropped packets recorded if DAI is enabled, which can be seen if you use (config)#ip arp
inspection vlan logging command.
DAI is supported on access ports, trunk ports, EtherChannel ports, or PVLAN.
By design, you should enable DAI on ports that are connected to legit routers, switches,
and other devices but usually not on end devices.
To enable DAI, use (config)#ip arp inspection vlan VID_RANGE, all switch ports belong to
this VLAN will be inspected because they are untrusted by default.
To specify that a port is trusted, use (config-if)#ip arp inspection trust.
Verify with show ip arp inspection {vlan VID | interface TYPE MOD NUM}
To statically define DAI permissions, use ACL to define static MAC-to-IP binding.
(config)#arp access-list acl-name -> (config-acl)#permit ip host SOURCE_IP mac host
SOURCE_MAC [log].
To apply this, use (config)#ip arp inspection filter ARP_ACL_NAME vlan VID [static]
ARP packets going through this interface are matched against the ACL. If no match is
found, the DHCP snooping database is searched (if enabled). Using static keyword forces
the switch to only check the ACL, if no match is found, frame consider illegal.
Verify with show arp access-list
By default, the switch checks the MAC and IP address contained in the ARP reply. You can
further configure with (config)#ip arp inspection validate {src-mac | dst-mac | ip [allow
zeros]} command.
- src-mac compares the source MAC address in Ethernet header to sender MAC address
(should be the same) on ARP request and reply.
- dst-mac compares the destination MAC address in the Ethernet header with recipient MAC
address (should be the same) in the ARP reply.
- ip check the senders IP address in all ARP request and replies, and recipients IP address
in all ARP replies. The addresses should be any multicast or 0.0.0.0 or 255.255.255.255.
allow zero modifies ip so sender of 0.0.0.0 is not denied.
Verify with show ip arp inspection {vlan VID | interface TYPE MOD NUM}
IP source guard
Address spoofing is the use of address within the subnet while not really existent so any
return traffic cant find its way back. This is the IP spoofing attack.
IP source guard works with DHCP snooping or static configured IP source binding to block
this type of attack. The binding table contains the IP address and associated MAC and VLAN
numbers. Per-port and VLAN ACL (PVACL) is installed on each port with binding table entry
to permit/deny traffic. IP source guard only works on access or trunk ports.
For a source to be trusted, either
- Its MAC address and corresponding IP address must match an entry in source IP and MAC
address filter or PVACL. To be able to receive DHCP information, option-82 must be
configured
- Its IP address must match an entry in source IP address filter or PVACL.
To enable IP source guard, use
- (config-if)#ip verify source [port-security] for lower-end switch model such as 3750. With
port-security, IP and corresponding MAC addresses are matched from PVACL. Without it,
only IP address is compared with PVACL entry.
- (config-if)#ip verify source vlan dhcp-snooping [port-security] for higher end switches
such as 4500 and 6500
Binding table can be statically compiled with (config)#ip source binding MAC_ADD vlan
VID IP_ADD interface TYPE MOD/NUM
To verify IP source guard, use show ip verify source [interface TYPE MOD/NUM]
To verify IP source binding database, use show ip source binding [IP_ADD] [MAC_ADD]
[dhcp-snooping | static] [interface TYPE MOD/NUM] [vlan VID]
Not supported on EtherChannel
VLAN hopping
VLAN hopping is used to compromise devices on another VLAN. Two primary methods are:
- Switch spoofing by impersonate (imitate) a switch by generating signals such as 802.1q
and DTP. If the attacker can successfully form a trunk with the switch, it can get data from
any VLAN. To reach a remote switch, it sends a frame to the native VLAN, which can be
forwarded without going through a L3 device. To prevent this,
^ Disable DTP by (config-if)#switchport nonegotiate on trunk links
^ Configure all other links to access ports
^ Configure a different native VLAN then prune it from the trunk (Although maintenance
protocols such as CDP, PAgP, and DTP normally are carried over the native VLAN of a trunk,
they will not be affected if the native VLAN is pruned from the trunk. They still will be sent
and received on the native VLAN as a special case even if the native VLAN ID is not in the
list of allowed VLANs. VLAN 1, and 1002 - 1005 is not allowed to be pruned.)
- Double tagging occurs when frames have two 802.1q tags so that when one is stripped off,
the switch will continue to forward it to the destination device. This attacks work even if
DTP is off. ISL is not used here as it would create a giant. To mitigate this situation, use
^ (config)#vlan dot1q tag native -> configures native VLAN to use 802.1Q tag
802.1x is a LAN authentication protocol used to grant user access to network and enforce
policy. RADIUS is the protocol used to relay the message to a database where all the
credentials are stored. Therere 3 roles in this process:
- Supplicant/client is an end device that support EAP and 802.1x. Its credentials are send
using EAPOL frames (at 0180.C300.0003) and secured with 802.1x. This frame can travel
across any Data Link Layer protocol such as Token Ring, FDDI, or Ethernet.
- Authenticator is an intermediate point that verify authenticity of EAPOL and encapsulate it
in RADIUS format to relay the credential to the authentication server. When the frame
comes back, the RADIUS format is removed and 802.1x frame is send to the client. It may
also be the authentication server. Must support 802.1x, EAP, and RADIUS.
- Authentication server can be Cisco ACS, but it must support RADIUS with EAP extension.
The client first send an EAPOL frame to start authentication, authenticator send back a
login request asking for credentials. Credentials from client will be relayed (using RADIUS)
to the server, which checks its database. If no match is found, the client stays blocked.
If match is found, server send back a response demanding further information. If the client
reply with the correct information, s/he is permitted access. VLAN assignment is added to
access-accept packet from the server.
If the client log outs, the process restart if s/he wants to log back in.
Here is how a EAPOL frame looks like:
By default, AAA is disabled, you can enable it with (config)#aaa new-model command. The
new-model keyword refers to the use of method lists, by which authentication methods
and sources can be grouped or organized. The new model is much more scalable than the
old model, in which the authentication source was explicitly configured.
Define external RADIUS server with its secret password (encryption key) by
(config)#radius-server host {HOSTNAME | IP_ADD} [key PASSWORD]. More than one
RADIUS server can be configured.
Apply the RADIUS server to be used for 802.1x authentication by (config)#aaa
authentication dot1x default group radius.
Switch ACLs
Port ACL (PACL) on the other hand, is similar to router ACL or (RACL) but are supported
and configured on Layer 2 interfaces, both physical and EtherChannel. PACL are not
supported on PVLAN and cant be logged or reflexive.
This ACL is created in ACL TCAM can be configured as either standard or extended IP or
MAC ACL. Port ACL perform access control on all incoming traffic entering a specific Layer 2
port but not on control packets such as DTP, STP, etc.
MAC ACLs are configured with (config)#{mac | ip} access-list extended NAME, then apply
it at an interface with (config-if)#{mac | ip} access-group {NAME | NO}.
Know that you can apply only one ACL to an interface; either MAC or IP, not both.
(config-if)#access-group mode command can change the way PACL interact with other
ACLs. Here are the parameters:
- prefer port: If a PACL is configured for an interface, it overrides all other ACLs. If no PACL
is configured, other features combine to produce overall result. Default for 4500, used on
both 4500 and 6500
- prefer vlan: VACL override PACL if there is any. PACL only used when VACL is not present.
Used on 4500
- merge: merge all available ACL. Default on 6500.
Router ACL (or RACL) filter inter-VLAN packets and is compiled into TCAM. Packets in the
same VLAN can only be filtered by VLAN ACL, or VACL. VACL is also merged into TCAM
table. VACL doesnt specify direction (in/out) nor interface (only to VLANs)
VACL is configured as VLAN access map (like a route map) by (config)#vlan access-map
NAME [SEQ_NO]
Then, you use match statement along with ACL in match {ip | ipx | mac} address
{ACL_NO | ACL_NAME}. Note that MAC ACL cant be a named ACL.
Instead of set, you use action {drop | forward [capture] | redirect TYPE MODE/NUM}.
Apply VACL to a VLAN by (config)#vlan filter MAP_NAME vlan-list VID
Check with show vlan access-map command.
PVLAN
Private VLAN further limit the reachability of a host by transforming a broadcast segment
into a NBMA segment (reaching only specific ends). PVLAN uses 3 types of ports:
- Community VLAN: reach any member of that community, and devices with promiscuous
ports. Carry traffic between community and promiscuous ports.
- Isolated VLAN: carry traffic from members of VLAN to only promiscuous ports.
- Promiscuous: reach any other ports. Allow traffic between ports, usually a router or L3
switch. One promiscuous port/switch. Place ACL here.
Interface from promiscuous VLAN are in promiscuous mode, while devices from secondary
VLANs are in host mode. Promiscuous mode port exhibit bidirectional behavior while host
switch port exhibit unidirectional or logical behavior.
A PVLAN contains:
- PVLAN itself
- Secondary VLANs (community and isolated)
- Promiscuous port
Private VLANs are configured using special cases of regular VLANs and therefore, shouldnt
pass its configuration using VTP (switch should be VTP transparent); PVLANs are locally
significant to a switch. VLAN 1, and 1002 - 1005 cant be used as PVLAN.
PVLAN travel in the network just like any other VLAN
To configure a PVLAN, you need to
1) Create a primary VLAN: (config)#vlan PRI -> (config-vlan)#private-vlan primary
2) Map secondary VLANs to the primary VLAN: (config)#vlan PRI -> (configvlan)#private-vlan association {SEC_LIST | add SEC_LIST | remove SEC_LIST}
3) Map secondary VLANs to the physical L2 interface of primary VLAN and indicate its a
promiscuous port (gateway of the VLAN): (config)#interface TYPE MOD/NUM ->
(config-if)#switchport mode private-vlan promiscuous -> (config-if)#switchport
private-vlan mapping PRI SEC_LIST [{add SEC_LIST | remove SEC_LIST}]
4) Map secondary VLANs to SVI of the primary VLAN: (config)#interface vlan PRI ->
(config-if)#private-vlan mapping PRI SEC_LIST [{add SECO_VID} | {remove
SECO_VID}]
5) Create a secondary VLAN: (config)#vlan SEC -> (config-vlan)#private-vlan
{community | isolated}
6) Assign secondary PVLAN status and primary PVLAN association (config)#interface TYPE
MODE/NUM -> (config-if)#switchport mode private-vlan host -> (config-if)#switchport
private-vlan host-association PRI SEC. Note: there is only one secondary PVLAN specified
because a port can only belong to one secondary PVLAN.
When assigning using private VLAN, you dont need the switchport access vlan command
because switchport private-vlan association already mapped this.
Verify with show vlan private-vlan and show interface NAME switchport <- Mode +
association + mapping.
Storm control, also known as traffic suppression feature selectively block unicast, multicast
and broadcast traffic on a port. It monitors inbound packets (from the client) at 1-second
interval and match against configuration to decide what to do.
(config-if)#storm-control action {shutdown | trap} configures what to do when level of
packet usage is exceeded. It can either shutdown the interface or send a SNMP trap
messages.
(config-if)#storm-control {unicast | multicast | broadcast} level [UPPER] [LOWER]
configures the usage criteria. A single number (between 0 and 100) set the upper limit of
usage, if exceeded action will be taken. If bother upper and lower limit are set, the port
resumes processing when traffic drop to that level. This command can be configured for uni/
multi/broadcast individually.
Verify with show storm-control TYPE MOD/NUM {unicast | multicast | broadcast}
Protected ports are supported on lower end switch models (that doesn't support PVLAN).
Ports configured as protected doesnt communicate with other protected ports, only
unprotected ports.
- Protected ports cant communicate with other protected ports unless a Layer 3 device is
present
- Protected ports can transfer control protocol traffic (such as routing protocol, CDP, etc)
directly with other protected ports
- Protected ports can communicate directly with normal ports in the same subnet without L3
device.
Off by default, turned on with (config-if)#switchport protected command, and verify with
show interface NAME switchport. Protected ports are usually used with port blocking.
Port blocking is supported only in Catalyst 3750 and above. Switches, by default, flood
multicast and unknown unicast traffic (except the port where it comes from). You can stop
this with (config-if)#switchport block [multicast | unicast]. Off by default.
This command doesnt affect MAC address learning process. Even if an address aged out, it
can still get back in using the normal MAC learning process.
Error management
Error management is often done with a network-management application, but Cisco
Catalyst switch has the ability built-in so no application is needed. If a serious error occurs,
an alert can be issued to correct the problem.
Cisco Catalyst switches can automatically detect the error, which will cause it to shut down
the port to errdisabled state. The situation can be remedied if someone enabled the port, or
until a predetermined time has elapsed. You can change this behavior by (config)#[no]
errdisable detect cause [all | CAUSE_NAME]. Here is a list of causes you can change:
- all Detects every possible cause
- arp-inspection Detects errors with dynamic ARP inspection (DAI)
- bpduguard Detects when a spanning-tree bridge protocol data unit (BPDU) is received
on a port configured for STP PortFast
- channel-misconfig Detects an error with an EtherChannel bundle
- dhcp-rate-limit Detects an error with DHCP snooping
- dtp-flap Detects when trunking encapsulation is changing from one type to another
- gbic-invalid Detects the presence of an invalid GBIC or SFP module
- ilpower Detects an error with offering inline power
Miscellaneous
Supervisor and route processor redundancy
Important parts of the device, such as power cord, and forwarding engine, may have a
backup in case of failure. Switch platforms such as Catalyst 4500R and 6500 can accept 2
supervisor modules installed in a single chassis.
The active module is fully initialized while redundant module is only initialized to a certain
level, the more initialized a module it, the less time it takes for transition in failovers. The
redundant module can be in one of several modes. The mode a module is in affect how 2
supervisor module synchronize their information.
- Route processor redundancy (RPR): partially booted an initialized. Need to reload every
other module to initialize supervisor function. Failover generally take at least 2 minutes.
When secondary engine takes over, 1) all switching module are reloaded, 2) remaining
subsystem of MSFC are brought up, and 3) ACLs are reprogrammed into hardware.
- Route processor redundancy plus (RPR+) redundant supervisor reboots to allow supervisor
and route engine to initialize; no other modules need to reload allow port states to be
retained. Failover generally take between 30 - 60 seconds.
- Stateful switchover (SSO) fully booted and initialized. Startup and running-config is
synchronized, L2 switching and port state can continue without notice. Failover generally
take at least 1 second.
SRM (single-router mode) simply means that two route processors (integrated into the
supervisors) are being used, but only one of them is active at any time. In DRM (dual router
mode), two route processors are active at all times. HSRP usually is used to provide
redundancy in DRM.
Although RPR and RPR+ have only one active supervisor, the route processor portion is not
initialized on the standby unit. Therefore, SRM is not compatible with RPR or RPR+.
SRM is inherent with SSO, which brings up the standby route processor. You usually will
find the two redundancy terms together, as SRM with SSO.
You can configure the redundancy mode by: (config)#redundancy -> (config-red)#mode
{rpr | rpr-plus | sos}. If the switch is configuring for redundancy the first time, you must
enter redundancy command on both supervisor modules. When the redundancy mode is
enabled, you will make all configuration changes on the active supervisor only. The running
configuration is synchronized automatically from the active to the standby module.
Verify with show redundancy states
If you configure RPR+ with the rpr-plus keyword, the supervisor attempts to bring up RPR
+ with its peer module. The IOS images must be of exactly the same release before RPR+
will work. If the images differ, the supervisor automatically falls back to RPR mode instead.
Verify with show redundancy states
You can also configure the synchronization between active and standby supervisor.
(config)#redundancy -> (config-red)#main-cpu -> (config-r-mc)#auto-sync {startup-config
| config-register | bottler}!! Default (config-r-mc)#auto-sync standard
Configuration Commands
BGP
EIGRP
OSPF
IS-IS
Macro
Macro can save you some typing by defining it to type those long commands and only
refer to the macro name. For instance,
(config)#define interface-range MyGroup gig 2/0/1 , gig 2/0/3 2/0/5 , gig 3/0/1 , gig
3/0/10 , gig 3/0/32 3/0/48
(config)#interface range macro MyGroup
The above command create a macro called MyGroup for a specific command. Remember to
surround any commas and hyphens with spaces when you enter interface range commands.
StackWise
9 Catalyst 3750 switches can be stacked on one another to create a single switching unit
with 32 Gbps switching stack interconnect. All switches can use the same resources, and a
master switch is elected to centrally manage the stack and create the CAM and routing
table.
The election wins by:
Description
CrossStack
EtherChannel
Technology
1:N Master
Redundancy
Each switch in the stack participates in the master election and is therefore
eligible to be elected master in the event that the master fails.
Stacking Cable
Resiliency
When a break in the stacking cable is detected, switches begin sending data
using the alternate path that is currently operational.
Online Insertion
OIR allows switches to be added and removed from the switch stack while it is
and Removal (OIR) operational.
Distributed Layer 2 If the master switch fails, stack members continue Layer 2 forwarding using the
Forwarding
most recent tables received from the master.
RPR+ for Layer 3
Resiliency
As is the case with RPR+, each stack member is initialized and is ready to
assume the role of master if the current master fails.
Power redundancy
The redundant power supply must be identical and possess the same power input and
output. There are 2 redundancy mode for Catalyst 4500 and 6500: combined and
redundant.
Combined mode: both power supplies are used at the same time. Power as much modules
as needed. When one fail, the system powers down the modules for which there isnt
enough power.
Redundant mode: draw its full power from both power supplies. When one fails, the other
immediately start providing full power.
(config)#power redundancy-mode [combined | redundant] <--> show power
For Catalyst 3750, the power is located externally. Can be used with UPS.