Professional Documents
Culture Documents
ACN-1
Chapter 6
Objectives
Upon completion of this chapter, student should be able to understand the followings:
ACN-2
Chapter 6
LAN Design
ACN-3
Chapter 6
ACN-4
Chapter 6
ACN-5
Chapter 6
Access Layer
Interfaces with end devices. Routers, switches, bridges, wireless access points. Provides a means of connecting and controlling which devices are allowed to communicate on the network.
ACN-6 Chapter 6
Distribution Layer
Aggregates (funnels) data receives from the access Layer switches before it is transmitted to the core layer for routing to its final destination. Controls the flow of network traffic using policies performing routing functions between virtual LANs (VLANs) defined at the access layer. Distribution layer switches are typically high-performance devices that have high availability and redundancy to ensure reliability
ACN-7 Chapter 6
Core Layer
High speed backbone of the network. Connects to the Internet resources. Must be highly available and redundant as it is critical for interconnectivity between distribution layer devices Must be capable of quickly forwarding large amounts of data as it aggregates the traffic from all the distribution layer devices.
ACN-8 Chapter 6
Logical Layout
Physical Layout
ACN-9
Chapter 6
ACN-10
Chapter 6
ACN-12
Chapter 6
Link aggregation and high performance distribution and core layer switches provide near-wire speed at all layers. Chapter 6 ACN-13
Port security at the access layer and policies at the distribution layer make the network more secure. Chapter 6 ACN-14
Functionality
Rapid Recovery
Easier Troubleshooting
ACN-15
Chapter 6
The modular design allows a network to scale easily without becoming over-complicated or burdensome. Chapter 6 ACN-16
ACN-19
Chapter 6
ACN-21
Chapter 6
ACN-22
Chapter 6
ACN-23
Chapter 6
LAN Design
Topology Diagrams
Switch Features
ACN-24
Chapter 6
ACN-26
Chapter 6
ACN-27
Chapter 6
ACN-28
Chapter 6
Switch Features
Switch Form Factors: When selecting a switch, you need to decide between Fixed configuration or modular configuration. Stackable or non-stackable. The switch form factor (physical size) is important depending upon where the switch will be installed. Wiring closet with limited space. Computer room with free standing racks. Shelf in a central area.
ACN-29
Chapter 6
Switch Features
Fixed Configuration Switches: Fixed in their configuration. You cannot add features or options to the switch beyond those that originally came with the switch.
ACN-30
Chapter 6
Switch Features
Modular Switches: Offer more flexibility. Typically come with different sized chassis that allow for the installation of different numbers of modular line cards. The line cards actually contain the ports.
ACN-31
Chapter 6
Switch Features
Stackable Switches: Interconnected using a special backplane cable that provides high-bandwidth throughput between the switches (Cisco StackWise). The stacked switches effectively operate as a single, larger switch. Desirable when fault tolerance and bandwidth availability are critical and a modular switch is too costly to implement.
ACN-32
Chapter 6
Switch Performance
When selecting a switch for the access, distribution, or core layer, consider the ability of the switch to support: Port Density. Forwarding Rate. Bandwidth Aggregation Requirements.
ACN-33
Chapter 6
Switch Performance
Port Density: Port density is the number of ports available on a single switch. 24 Port
48 Port
Switch Performance
Forwarding Rate: Defines the processing capabilities of a switch by rating how much data the switch can process per second. If the switch forwarding rate is too low, it cannot accommodate full wire-speed communication across all of its switch ports. A 48 port Gigabit switch is capable of switching 48 Gigabits of traffic.
ACN-35
Chapter 6
Switch Performance
Forwarding Rate: Access layer switches typically do not need to operate at full wire speed because they are physically limited by their uplinks to the distribution layer. Allows the use of: Less expensive, lower performing switches at the access layer. More expensive, higher performing switches at the distribution and core layers, where the forwarding rate makes a bigger difference.
ACN-36
Chapter 6
Switch Performance
Link Aggregation: As part of bandwidth aggregation, you should determine if there are enough ports on a switch to aggregate to support the required bandwidth. 24 Port Gigabit Up to 8 ports bound together to provide up to Single Port - 1 Gigabit 8 Gigabits. BOTTLE NECK
ACN-37
Chapter 6
Switch Performance
Power over Ethernet (PoE): Allows the switch to deliver power to a device over the existing Ethernet cabling.
Switch Performance
Layer 3 Functionality: Switches typically operate at Layer 2 of the OSI Model.
ACN-39
Chapter 6
Link Aggregation
VLANs
PoE FastEthernet/Gigabit
ACN-40
Chapter 6
Layer 3 Support
High Forwarding Rate
Link Aggregation
Redundant Components
Gigabit/10 Gigabit
u u
u u u u
u u u
u u u
u u u
u u u
u
Chapter 6
Objectives
Upon completion of this chapter, student should be able to understanding the followings: Operations of Ethernet Ethernet Network Design Considerations Switch Forwarding & Buffering Methods Common Security Attacks on Switches Switch Configurations & Basic Management
ACN-46
Chapter 6
ACN-47
Chapter 6
CSMA/CD
ACN-48
Chapter 6
Ethernet Communications
Unicast: one-to-one
Broadcast: one-to-all
Multicast: one-to-many
ACN-49
Chapter 6
Ethernet Communications
Ethernet Frame: Minimum 64 bytes, Maximum 1518 bytes
Preamble/SOFD: Synchronize to medium. Destination Address: MAC Address of destination device. Source Address: MAC address of source device. Length/Type: Length of frame or protocol type code. Data: Encapsulated data from OSI Layers 7 to 3. FCS: Frame Check Sequence.
Chapter 6
ACN-50
Ethernet Communications
MAC Address:
Broadcast: Indicates a broadcast or multicast frame. Local: indicates whether the address can be modified locally. OUI Number: Manufacturer of the NIC. Vendor Number: Unique, vendor assigned number. MAC address= Layer 2 add/ Physical add/ Hardware add/ Burn-in-address (BIA) 6-byte OR 48-bit OR 12-hexadecimal digit Format: 00-05-9A-3C-78-00, 00:05:9A:3C:78:00, or 0005.9A3C.7800 Chapter 6 ACN-51
Ethernet Communications
ACN-52
Chapter 6
Ethernet Communications
Switch Port Settings: AUTO: (more) Auto-negotiation of duplex mode. The two ports communicate to determine the best mode. Default for FastEthernet and 10/100/1000 ports. FULL: Full-duplex mode. Default for 100BASE-FX ports. HALF: Half-duplex mode.
ACN-53
Chapter 6
Ethernet Communications
Switch Port Settings: AUTO: Auto-negotiation of duplex mode. The two ports communicate to determine the best mode. Auto-negotiation can produce unpredictable results. If auto-negotiation fails because the attached device does not support it, the Catalyst switch defaults the switch port to half-duplex mode. Half-duplex on one end and full-duplex on the other causes late collision errors at the half-duplex end. To avoid this, manually set the duplex parameters of the switch to match the attached device.
ACN-54 Chapter 6
Late Collisions A late collision is a collision packet usually larger than 64 bytes with a corrupted CRC field value. a collision occurs with less than the normal 64 bytes of transmission means a normal collision A collision occurs with greater than 64 bytes of data is considered "late" because it did not occur before the 64-byte transmission ratio. Late collisions can cause a high number of bytes to be transmitted on the network than with a normal collision under 64 bytes. More often this indicates that the station's NIC transmitting the collision cannot hear properly to stop its transmission and will continue to broadcast high collision rates on the network.
ACN-55
Chapter 6
Ethernet Communications
Switch Port Settings: Auto-MDIX feature: In the past, either a cross-over or a straight-through cable was required depending on the type of device that was being connected to the switch. Instead, the mdix auto interface configuration command enables the automatic medium-dependent interface crossover (auto-MDIX) feature. With this feature enabled, the switch detects the interface required for copper media and configures the interface accordingly.
ACN-56
Chapter 6
ACN-58
Chapter 6
ACN-59
Chapter 6
ACN-60
Chapter 6
ACN-61
Chapter 6
ACN-62
Chapter 6
ACN-63
Chapter 6
ACN-65
Chapter 6
ACN-66
Chapter 6
ACN-68
Chapter 6
ACN-69
Chapter 6
ACN-70
Chapter 6
ACN-71
Chapter 6
Hub
ACN-72 Chapter 6
Collision
JAM
JAM
JAM
JAM
JAM
JAM
JAM
JAM
Hub
ACN-73 Chapter 6
Switch
ACN-74 Chapter 6
Router
ACN-75 Chapter 6
ACN-76
Chapter 6
ACN-77
Chapter 6
Switches at Layer 2 can introduce latency on a network when oversubscribed on a busy network. If a core level switch has to support 48 ports, each one capable of running at 1000 Mb/s full duplex, the switch should support around 96 Gb/s internal throughput if it is to maintain full wire speed across all ports simultaneously.
ACN-78 Chapter 6
The use of higher layer devices can also increase latency on a network. When a Layer 3 device, such as a router, needs to examine the Layer 3 addressing information contained within the frame, it must read further into the frame than a Layer 2 device, which creates a longer processing time.
ACN-79 Chapter 6
ACN-80
Chapter 6
Store-and-forward
Symmetric Cut-through Asymmetric
Fast-forward
Fragment-free
ACN-81
Memory Buffering
ACN-82
Chapter 6
ACN-83
Chapter 6
ACN-84
Chapter 6
ACN-85
Chapter 6
ACN-87
Chapter 6
ACN-88
Chapter 6
Memory Buffering
A switch analyzes some or all of a packet before it forwards it to the destination host based on the forwarding method. It stores the packet for the brief time in a memory buffer. Built into the hardware Two types: Port based. Shared.
ACN-89
Chapter 6
Memory Buffering
Port Based: Frames are stored in queues that are linked to specific incoming and outgoing ports. A frame is transmitted to the outgoing port only when all the frames ahead of it in the queue have been successfully transmitted. It is possible for a single frame to delay the transmission of all the frames in memory because of a busy destination port.
ACN-90
Chapter 6
Memory Buffering
Shared: Deposits all frames into a common memory buffer that all the ports on the switch share. The amount of buffer memory required by a port is dynamically allocated. The frames in the buffer are linked dynamically to the destination port. Allows the packet to be received on one port and then transmitted on another port, without moving it to a different queue.
ACN-91
Chapter 6
ACN-92
Chapter 6
ACN-94
Chapter 6
ACN-95
Chapter 6
ACN-97
Chapter 6
ACN-98
Chapter 6
ACN-99
Chapter 6
ACN-100
Chapter 6
ACN-101
Chapter 6
ACN-102
Chapter 6
ACN-103
Chapter 6
ACN-104
Chapter 6
ACN-105
Chapter 6
ACN-106
Chapter 6
ACN-107
Chapter 6
ACN-108
Chapter 6
ACN-109
Chapter 6
ACN-110
Chapter 6
ACN-111
Chapter 6
ACN-112
Chapter 6
ACN-113
Chapter 6
ACN-115
Chapter 6
ACN-116
Chapter 6
ACN-117
Chapter 6
ACN-118
Chapter 6
ACN-119
Chapter 6
ACN-120
Chapter 6
ACN-121
Chapter 6
ACN-123
Chapter 6
ACN-124
Chapter 6
ACN-125
Chapter 6
ACN-126
Chapter 6
ACN-128
Chapter 6
ACN-129
Chapter 6
ACN-130
Chapter 6
ACN-131
Chapter 6
ACN-133
Chapter 6
Security Tools
Passwords Encryption Telnet Attacks Port Security CDP Attacks Telnet / SSH
ACN-134
Spoofing Attacks
Password Recovery
Chapter 6
ACN-135
Chapter 6
ACN-136
Chapter 6
ACN-137
Chapter 6
password cisco
ACN-138
Chapter 6
Login Banners
Login Banner:
ACN-140
Chapter 6
ACN-141
Chapter 6
ACN-142
Chapter 6
ACN-143
Chapter 6
ACN-144
Chapter 6
ACN-145
Chapter 6
Chapter 6
ACN-149
Chapter 6
ACN-151
Chapter 6
ACN-153
Chapter 6
ACN-154
Chapter 6
ACN-156
Chapter 6
ACN-157
Chapter 6
ACN-158
Chapter 6
Specify a maximum
ACN-159
ACN-160
Chapter 6
ACN-161
Chapter 6
You can specify a range of interfaces. For example, to specify the first 10 interfaces: interface range fastethernet 0/1 - 10
ACN-162 Chapter 6
ACN-163
Chapter 6
Objectives
Upon completion of this chapter, students should be able to understand the followings: Overview of VLAN Benefits of VLANs Types of VLANs Network Traffic Types Controlling Broadcast Domains with VLANs VLAN Trunking & 802.1Q Tagging VLAN Configurations
ACN-164
Chapter 6
Defining VLANs
In traditional switched LANs, the physical topology is closely related to the logical topology. Generally, workstations must be grouped by their physical proximity to a switch. To communicate among LANs, each segment must have a separate port on the backbone device or a connection to a common backbone.
ACN-165
Chapter 6
Defining VLANs
VLANs provide segmentation based on broadcast domains. VLANs logically segment switched networks based on the functions, project teams, or applications of the organization regardless of the physical location or connections to the network. Communication among VLANs still require a router. BUT, only one physical connection will handle all routing.
ACN-166
Chapter 6
Defining VLANs
VLANs are created to provide segmentation services traditionally provided by physical routers in LAN configurations. They address: Scalability Security Network Management Broadcast Filtering Traffic Flow Management Switches may not forward any traffic between VLANs, as this would violate the integrity of the VLAN broadcast domain. Traffic must be routed between VLANs.
ACN-167 Chapter 6
Requirements: - Different department on each floor. - Three different LANs per floor. - Separate networks
ACN-168
Chapter 6
With routers:
Expen$ive!
- 4 Ports each - 3 hubs / floor - 10 Broadcast domains - Inefficient traffic flow
ACN-169
Chapter 6
With switches:
- More scalable - Easier to manage - 1 Router - 4 Broadcast Domains - Efficient traffic flow
ACN-170
Chapter 6
Defining VLANs
A VLAN, then, is a broadcast domain (IP Subnet) created by one or more switches.
ACN-171 Chapter 6
Defining VLANs
The above design shows 3 separate broadcast domains created using one router with 3 ports and 3 switches. The router filters the broadcasts for each LAN.
ACN-172 Chapter 6
Defining VLANs
One Physical Link
A better design still creates the 3 separate broadcast domains but only requires 1 switch. The router provides broadcast filtering over a single link.
ACN-173 Chapter 6
Defining VLANs
A VLAN allows: Creation of groups of logically networked devices. The devices to act as if they are on their own independent network. The devices can share a common infrastructure. Each VLAN is a separate broadcast domain. Broadcast traffic is controlled where a frame in a VLAN stays in that VLAN. Each VLAN is a assigned with a separate IP subnet address. To communicate among VLANs, you must use a router (more later).
ACN-174 Chapter 6
Benefits of VLANs
Security: Groups with specific security needs (sensitive data) are isolated from the rest of the network. decreasing the chances of confidential information breaches. Cost Reduction: Need for expensive hardware upgrades is reduced. Better use of existing bandwidth and links. Higher Performance: Dividing large, flat Layer 2 networks into separate broadcast domains reduces unnecessary traffic on each new subnet.
ACN-175
Chapter 6
Benefits of VLANs
Broadcast Storm Mitigation: Dividing a network into VLANs prevents a broadcast storm from propagating to the whole network. Improved IT Staff Efficiency: Easier to manage the network because users with similar network requirements share the same VLAN. Simpler Project or Application Management: Having separate functions makes working with a specialized application easier. For example, an e-learning development platform for faculty.
ACN-176
Chapter 6
VLAN ID Ranges
When configured, the number that is assigned to the VLAN becomes the VLAN ID. The numbers to be assigned are divided into two different ranges: Normal Range: 1 1005 Extended Range: 1006 - 4096 Each range has its own characteristics.
ACN-177
Chapter 6
VLAN ID Ranges
Normal Range: 1 1005 Used in small- and medium-sized business and enterprise networks. IDs 1002 1005: Token Ring and FDDI VLANs. IDs 1 and 1002 to 1005 are automatically created and cannot be removed. Configurations are stored within a VLAN database file, called vlan.dat, located in the flash memory of the switch. The VLAN Trunking Protocol (VTP), which helps manage VLAN configurations between switches, can only learn normal range VLANs and stores them in the VLAN database file.
ACN-178 Chapter 6
VLAN ID Ranges
Extended Range: 1006 4096 Enable service providers to extend their infrastructure to a greater number of customers. Some global enterprises could be large enough to need extended range VLAN IDs. Support fewer VLAN features than normal range VLANs. Are saved in the running configuration file not the vlan.dat file. VTP does not learn extended range VLANs.
ACN-179
Chapter 6
Types of VLANs
Traditionally, two methods of implementing VLANs: Static or Port-Based: Ports on a switch are assigned to a specific VLAN. Dynamic: VLANs created by accessing a Network Management server. The MAC address/VLAN ID mapping is set up by the Network Administrator and the server assigns a VLAN ID when the device contacts it.
ACN-180
Chapter 6
ACN-181
Chapter 6
ACN-182
Chapter 6
ACN-183
Chapter 6
ACN-184
Chapter 6
ACN-185
Chapter 6
ACN-186
Chapter 6
ACN-187
Chapter 6
ACN-188
Chapter 6
Connections
ACN-190
Chapter 6
ACN-191
Chapter 6
MORE on the tagging process later Receiving: Phone acts on voice traffic and removes the tag for data traffic destined for the PC.
ACN-192
Chapter 6
Link to the switch acts as a trunk link to carry both voice and data traffic.
CDP
ACN-193
Chapter 6
ACN-194
Chapter 6
ACN-195
Chapter 6
ACN-196
Chapter 6
IP/TV Broadcasts
ACN-197
Sent from a particular source address to a multicast group that is identified by a single IP and MAC destination-group address pair.
Chapter 6
ACN-198
Chapter 6
Less than best-effort services. Typically entertainment oriented. Peer-to-Peer Media Sharing (KaZaa, Napster), Gaming.
ACN-199
Chapter 6
ACN-201
Chapter 6
ACN-203
Chapter 6
Remember that the entire network must be set up to prioritize voice traffic. You cannot just configure the switch port.
ACN-204 Chapter 6
ACN-205
Chapter 6
Sends a Broadcast
ACN-206
Chapter 6
ACN-207
Chapter 6
ACN-208
Chapter 6
ACN-209
Chapter 6
ACN-210
Chapter 6
ACN-211
Chapter 6
ACN-212
Chapter 6
VLAN Trunking
ACN-213
Chapter 6
VLAN Trunking
The concept of trunking began with the telephone industry. Multiple calls were moved between customers and central offices or between the offices themselves over a single physical connection.
ACN-214 Chapter 6
VLAN Trunking
24 Channel T1 Line with Data and Voice
The same principle was applied to data communications to make better use of the communication line. Additional advantages and cost savings were gained by using the same line for voice communications.
ACN-215 Chapter 6
VLAN Trunking
No trunk
Trunk
The same principle of trunking is applied to network switching technologies. A trunk is a point-to-point physical and logical connection between two switches across which network traffic travels. The trunk by default carries all VLAN data, unless otherwise Chapter 6 ACN-216 configured for specific VLANs.
VLAN Trunking
It is also important to realize that a trunk link does not belong to a specific VLAN. The responsibility of a trunk link is to act as a conduit for VLANs. Between switches and routers. Between switches and switches.
ACN-217
Chapter 6
VLAN Trunks
What problem does it solve? Network 172.17.10.0/24 Network 172.17.20.0/24 Network 172.17.30.0/24 Network 172.17.99.0/24
ACN-218
Chapter 6
ACN-219
Chapter 6
ACN-220
Chapter 6
Ethernet Type
3 Bits
User Priority
1 Bit
CFI
12 Bits
VLAN ID
With the EtherType field set to the TPID value, the switch receiving the frame knows to look for information in the tag control information field.
ACN-221 Chapter 6
Native VLANs
Tagged Frames on the native VLAN. Some devices that support trunking tag native VLAN traffic as a default behavior. Control traffic sent on the native VLAN should be untagged. If an 802.1Q trunk port receives a tagged frame on the NATIVE VLAN ONLY, it drops the frame. When configuring a switch port on a Cisco switch, you need to identify these devices and configure them so that they do not send tagged frames on the native VLAN. Devices from other vendors that support tagged frames on the native VLAN include IP phones, servers, routers, and switches.
ACN-222 Chapter 6
Native VLANs
Un-Tagged Frames on the native VLAN. When a Cisco switch trunk port receives untagged frames it forwards those frames to the native VLAN. Default native VLAN is VLAN 1. When you configure an 802.1Q trunk port, a default Port VLAN ID (PVID) is assigned the value of the native VLAN. All untagged traffic coming in or out of the 802.1Q port is forwarded based on the PVID value.
ACN-223
Chapter 6
Native VLANs
Configure the trunk to default to native VLAN 1.
ACN-224
Chapter 6
Native VLANs
Verify the configuration. VLAN 50 is a voice VLAN.
ACN-225
Chapter 6
Trunking Operation
The tagged frames are sent across the trunk links between S2 and S1 and S1 and S3.
10
20
20
30
30
S2 receives the frames and tags them with the VLAN ID.
ACN-226
Trunking Modes
A Cisco switch can be configured to support two types of trunk ports: IEEE 802.1Q ISL (Inter-Switch Link)
Today only 802.1Q is used. Legacy networks may still use ISL.
ACN-227
Chapter 6
Trunking Modes
IEEE 802.1Q: Assigned a default PVID. Supports simultaneous tagged and untagged traffic. Untagged traffic: Associated with the port default PVID. Null VLAN ID traffic belongs to the default PVID. Tagged traffic: VLAN ID equal to the outgoing port default PVID is sent untagged. Null VLAN ID traffic belongs to the default PVID. All other traffic is sent with a VLAN tag.
ACN-228
Chapter 6
Trunking Modes
ISL (Inter-Switch Link): All received packets are expected to be encapsulated with an ISL header. All transmitted packets are sent with an ISL header. Untagged frames received from an ISL trunk port are dropped. No longer recommended or supported. 30 bytes of overhead for each frame..
ACN-229
Chapter 6
Trunking Modes
Dynamic Trunking Protocol (DTP): Cisco proprietary protocol. Switches from other vendors do not support DTP. Automatically enabled on a switch port when certain trunking modes are configured on the switch port. DTP manages trunk negotiation only if the port on the other switch is configured in a trunk mode that supports DTP. DTP supports both ISL and 802.1Q trunks. Some Cisco switches and routers (older versions) do not support DTP.
ACN-230
Chapter 6
Trunking Modes
Dynamic Trunking Protocol (DTP): On (default): (switchport mode trunk) Periodically sends DTP advertisements, to the remote port that it is dynamically changing to a trunking state. Dynamic Auto: (switchport mode dynamic auto) The switch port periodically sends DTP frames to the remote port. It advertises to the remote switch port that it is able to trunk but does not request to go to the trunking state. Dynamic Desirable: (switchport mode dynamic desirable) DTP frames are sent periodically to the remote port. It advertises to the remote switch port that it is able to trunk and asks the remote switch port to go to the trunking state.
ACN-231 Chapter 6
Trunking Modes
Dynamic Trunking Protocol (DTP): Turn off DTP: (switchport nonegogiate) The local port does not send out DTP frames to the remote port. The local port is then considered to be in an unconditional trunking state. Use this feature when you need to configure a trunk with a switch from another switch vendor.
ACN-232
Chapter 6
ACN-233
Chapter 6
ACN-234
Chapter 6
Configure a VLAN
Command Syntax: S1#configure terminal S1(config)#vlan vlan id S1(config-vlan)#name vlan name S1(config-vlan)#end
ACN-235
Chapter 6
Configure a VLAN
Configure a VLAN
ACN-236
Chapter 6
Configure a VLAN
Assign switch ports to a VLAN
ACN-237
Chapter 6
Configure a VLAN
Verify VLAN configuration
ACN-238
Chapter 6
Managing VLANs
Other show vlan command options
ACN-239
Chapter 6
Managing VLANs
show interfaces command
ACN-240
Chapter 6
Managing VLANs
Manage VLAN Memberships
ACN-241
Chapter 6
Managing VLANs
Manage VLAN Memberships
Remove a VLAN
If you remove the VLAN before removing the port membership assignments, the ports become unusable until you issue the no switchport access vlan command.
ACN-242 Chapter 6
Managing VLANs
Restoring to Factory Defaults: To remove all VLAN configuration:
ACN-243
Chapter 6
Configure a Trunk
Command Syntax: S1#configure terminal S1(config)#interface interface-id S1(config-if)#switchport mode trunk S1(config-if)#switchport trunk native vlan vlan-id S1(config-if)#switchport trunk allowed vlan add vlan-list S1(config-vlan)#end
ACN-244 Chapter 6
Configure a Trunk
ACN-245
Chapter 6
Configure a Trunk
ACN-246
Chapter 6
ACN-247
Chapter 6
ACN-248
Chapter 6
The vlan-list is a list of the VLAN IDs, separated by commas, that will be allowed to use the trunk link. The lists must match on both switches.
ACN-249
Chapter 6
ACN-251
Chapter 6
Objectives
Upon completion of this chapter, students should be able to understand the followings: VTP Concepts VTP Operations VTP Configurations
ACN-252
Chapter 6
What is VTP?
The VLAN Trunking Protocol (VTP) allows you to simplify the management of the VLAN database across multiple switches. As the number of switches increases on a small- or mediumsized business network, the overall administration required to manage VLANs and trunks in a network becomes a challenge.
ACN-253
Chapter 6
What is VTP?
Simple Network.
What is VTP?
How about now?
ACN-255
Chapter 6
What is VTP?
How does it work?
VTP Server
VTP Clients
ACN-256 Chapter 6
Benefits of VTP
The VLAN Trunking Protocol (VTP) allows you to simplify the management of the VLAN database across multiple switches. Benefits: VLAN configuration consistency across the entire network. (created, deleted, or renamed) Accurate tracking and monitoring of VLANs. Dynamic reporting of added VLANs across a network. Dynamic trunk configuration when VLANs are added to the network
ACN-257
Chapter 6
VTP Components
VTP Domain: Consists of one or more interconnected switches. All switches in a domain share VLAN configuration details using VTP advertisements. Router or Layer 3 switch defines the boundary of domain.
ACN-258
Chapter 6
VTP Components
VTP Advertisement: VTP uses a hierarchy of advertisements to distribute and synchronize VLAN configurations across the network.
new
ACN-259
Chapter 6
VTP Components
VTP Modes: Three different modes: (more) Server, Client, Transparent
ACN-260
Chapter 6
VTP Components
VTP Server: VTP servers advertise the VTP VLAN information to other switches in the same VTP domain. The server is where VLANs can be created, deleted, or renamed for the domain.
ACN-261
Chapter 6
VTP Components
VTP Client: VTP clients Forward advertisements to other clients. You cannot create, change, or delete VLANs. You must configure VTP Client mode.
ACN-262
Chapter 6
VTP Components
VTP Transparent: forward VTP advertisements to VTP clients and VTP servers. do not participate in VTP. VLANs that are created, renamed, or deleted on transparent switches are local to that switch only.
new
ACN-263
Chapter 6
VTP Components
VTP Pruning: VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links used to reach the destination devices. Without VTP pruning, broadcasts, multicasts and unknown unicasts are flooded across all trunk links within a VTP domain. What it means is that the destination switch does not have the same VLAN as the switch that initiates the broadcast.
ACN-264 Chapter 6
VTP Operation
ACN-265
Chapter 6
NO Domain Name
Version 2 Disabled
ACN-266
Chapter 6
new
ACN-267
Chapter 6
VTP Domains
VTP allows you to separate your network into smaller management domains to help reduce VLAN management. VTP domains limits the extent to which configuration changes are propagated in the network if an error occurs A switch can be a member of only one VTP domain at a time. Until the VTP domain name is specified, you cannot create or modify VLANs on a VTP server, and VLAN information is not propagated over the network.
ACN-268
Chapter 6
VTP Domains
ACN-269
Chapter 6
VTP Domains
For a VTP server or client switch to participate in a VTPenabled network, it must be a part of the same domain. Domain name propagation uses three VTP components: servers, clients, and advertisements.
ACN-270
Chapter 6
VTP Advertising
VTP Frame Structure: VTP advertisements (or messages) distribute VTP domain name and VLAN configuration changes to VTPenabled switches. The VTP frame is encapsulated in the same manner as any other tagged frame.
ACN-271
Chapter 6
VTP Advertising
VTP Frame Details:
ACN-272
Chapter 6
ACN-274
Chapter 6
ACN-275
Chapter 6
ACN-277
Chapter 6
VTP Modes
A Cisco switch can be configured in either: Server mode Client mode Transparent mode These modes differ in how they are used to manage and advertise VTP domains and VLANs.
ACN-278
Chapter 6
VTP Modes
VTP Server Mode:
ACN-279
Chapter 6
VTP Modes
VTP Client Mode:
ACN-280
Chapter 6
VTP Modes
VTP Transparent Mode:
ACN-281
Chapter 6
ACN-282
Chapter 6
S4 Requests
ACN-283
Chapter 6
VTP Pruning
VTP Pruning: Prevents unnecessary flooding of broadcast information from one VLAN across all trunks in a VTP domain. Permits switches to negotiate which VLANs are assigned to ports at the other end of a trunk and prune the VLANs that are not assigned to ports on the remote switch. Disabled by default. Enabled using the vtp pruning global configuration command.
ACN-284
Chapter 6
VTP Pruning
No pruning
VLAN 10, 20
ACN-285
VLAN 20
Chapter 6
Pruning enabled on S1
Configure VTP
ACN-286
Chapter 6
Configuring VTP
Configuration Guidelines:
ACN-287
Chapter 6
Configuring VTP
VTP Server Configuration:
ACN-288
Chapter 6
Configuring VTP
VTP Client Configuration:
ACN-289
Chapter 6
Configuring VTP
Connect the Devices and Verify VTP:
ACN-290
Chapter 6
Configuring VTP
Add the workstations to the appropriate VLAN. Use the show vlan brief command to verify.
ACN-291
Chapter 6
ACN-292
Chapter 6
Update
Not updated
ACN-293
Chapter 6
On a reboot, all VLAN configurations are lost. VTP clients do not store the configuration in NVRAM.
ACN-294 Chapter 6
ACN-295
Chapter 6
ACN-296
Chapter 6
ACN-297
Chapter 6
Objectives
Upon completion of this chapter, students should be able to understand the followings: Redundant Layer 2 Topologies Issues with Redundancy The Spanning Tree Protocol (STP) STP Convergence PVST+, RSTP, Rapid-PVST+
ACN-298
Chapter 6
ACN-299
Chapter 6
Redundancy
ACN-300
Chapter 6
Redundancy
ACN-301
Chapter 6
Redundancy
The Spanning Tree Protocol (STP) is enabled on all switches. STP has placed some switch ports in forwarding state and other switch ports in blocking state.
Forward
Blocked
ACN-302 Chapter 6
ACN-303
Chapter 6
ACN-304
Chapter 6
Remember that switches use the Source MAC address to learn where the devices are and enters this information into their MAC address tables. Switches will flood the frames for unknown destinations until they learn the MAC addresses of the devices.
ACN-305 Chapter 6
Additionally, multicasts and broadcasts are also flooded out all ports except the receiving port. (Multicasts will not be flooded if the switch has been specifically configured to handle multicasts.)
ACN-306 Chapter 6
S2 floods update the S3and S1 forward their and S1 the S3S3floodsoutthe S3 and S1 update S2 sends a its S2 updates all S2 and broadcast update S3 and S1S1 now PC1 receives again with their and tables MAC back the broadcastthe MACthe broadcast. MAC table updates frame MACagain broadcast with the ports tables flood except their the wrong broadcast.tables with information the wrongport. wrong to S2.information the MAC table. receiving information
ACN-307
Chapter 6
In fact, the entire network can no longer process new traffic and comes to a screeching halt.
Because of the high level PC2 sends a PC3 sends a STP so a a and PC1broadcast No ofsendsa it PC4 traffic, sends Another loop cannotbroadcastloop createsloopbebroadcast yet another broadcast is processed. created
ACN-308
Chapter 6
End result. PC4 receives two copies of the same S2 has no entry for One from S1 and one from S3. frame. S1 also forwards have Both S3 and S1 PC1 sends frame PC4 sofor PC4 so the the a entries frame the frame it unicast out the isframe from S3 flooded received is forwarded to PC4 remaining ports
ACN-309
Chapter 6
ACN-310
Chapter 6
ACN-311
Chapter 6
Introduction to STP
Redundancy: Increases the availability of the network topology by protecting the network from a single point of failure. In a Layer 2 design, loops and duplicate frames can occur, having severe consequences. The Spanning Tree Protocol (STP) was developed to address these issues. STP ensures that there is only one logical path between all destinations on the network by intentionally blocking redundant paths that could cause a loop. The switches running STP are able to compensate for failures by dynamically unblocking the previously blocked ports and permitting traffic to traverse the alternate paths.
ACN-312 Chapter 6
S1 forwards a andin STP is in use is S3 S2 forwards the Because F0/2 PC1 sends the broadcast portthe has placed but F0/2 blocking state, broadcast. broadcast. in not to S3.state to broadcast is not blocking forwarded back to avoid a loop. S2. NO LOOP!
ACN-313
Chapter 6
S3 port activated S3 port back to S3 and S1 forward S2 forwards a PC1 Sends the blocking mode. broadcast. the broadcast. broadcast.
ACN-314
Chapter 6
Bridge Priority
2
ACN-316
MAC Address
6
Chapter 6
Root Bridge
Election Process: All switches in the broadcast domain participate. After a switch boots, it sends out Bridge Protocol Data Units (BPDU) frames containing the switch BID and the root ID every 2 seconds. The root ID identifies the root bridge on the network. By default, the root ID matches the local BID for all switches on the network. In other words, each switch considers itself as the root bridge when it boots.
ACN-317
Chapter 6
Root Bridge
Election Process: As the switches forward their BPDU frames, switches in the broadcast domain read the root ID information from the BPDU frame. If the root ID from the BPDU received is lower than the root ID on the receiving switch, the receiving switch updates its root ID identifying the adjacent switch as the root bridge. The switch then forwards new BPDU frames with the lower root ID to the other adjacent switches. Eventually, the switch with the lowest BID ends up being identified as the root bridge for the spanning-tree instance.
ACN-318 Chapter 6
Best Path
Now that the root bridge has been elected, the STA starts the process of determining the best (lowest cost) paths to the root bridge from all destinations in the broadcast domain. The path information is determined by summing up the individual port costs along the path from the destination to the root bridge. The default port costs are specified by the IEEE and defined by the speed at which the port operates.
Link Speed 10Gbps 1Gbps 100Mbps 10Mbps
ACN-319
Cost 2 4 19 100
Chapter 6
Best Path
You are not restricted to the defaults. The cost of a path can be manually configured to specify that a specific path is the preferred path instead of allowing the STA to choose the best path. Realize, however, that changing the cost of a particular path will affect the results of the STA. The no form of the following command will return the cost to its default value.
switch(config)#interface fa0/1 switch(config-if)#spanning-tree cost [value] switch(config-if)#end
ACN-320
Chapter 6
Best Path
Verifying the port and path cost.
Port Cost
Path Cost
ACN-321
Chapter 6
Identifies the root bridge and the cost of the path to the root bridge.
ACN-322
Chapter 6
ACN-323
Chapter 6
BPDU Process
Root Bridge Election Process:
BPDU Process
Root Bridge Election Process:
BPDU Process
Root Bridge Election Process:
BPDU Process
Root Bridge Election Process:
Bridge ID
Early STP implementation no VLANs.
That means that there is a separate instance of STP for each VLAN.
ACN-328
Chapter 6
Bridge ID
ACN-329
Chapter 6
Bridge ID
Bridge Priority: A customizable value that you can use to influence which switch becomes the root bridge. (Another rigged election!) The switch with the lowest priority, which means lowest BID, becomes the root bridge. The lower the priority value, the higher the priority.
ACN-330
Chapter 6
Bridge ID
Bridge Priority: Notice that the addition of the VLAN ID leaves fewer bits available for the bridge priority (4 instead of 16). As a result, the bridge priority is assigned in multiples of 4096. The priority is added to the extended system value (VLAN ID) to uniquely identify the priority and VLAN of the BPDU frame.
ACN-331
Chapter 6
Bridge ID
Bridge Priority: For example: The default bridge priority is 32,769. (4096 * 8) + VLAN 1 ( native VLAN) If I assign bridge priority 24,576 for VLAN 1 (4096 *6), the bridge priority becomes 24,567 24,577 This switch will become the root bridge.
ACN-332
Chapter 6
Bridge ID
Bridge Priority:
ACN-333
Chapter 6
Bridge ID
Bridge Priority:
ACN-334
Chapter 6
Ensures that the switch will become the root bridge if the primary fails. This one assumes that all other switches have the default value.
ACN-335 Chapter 6
ACN-336
Chapter 6
ACN-337
Chapter 6
Port Roles
The root bridge is elected for the spanning-tree instance. The location of the root bridge in the network topology determines how port roles are calculated. Root Port: The switch port with the best path to forward traffic to the root bridge. Designated Port: The switch port that receives and forwards frames toward the root bridge as needed. Only one designated port is allowed per segment. Non-designated Port: A switch port that is blocked, so it is not forwarding data frames.
ACN-338 Chapter 6
Port Roles
The STA determines which port role is assigned to each switch port. To determine the root port on a switch: The switch compares the path costs on all switch ports participating in the spanning tree. When there are two switch ports that have the same path cost to the root bridge: The switch uses the customizable port priority value, or the lowest port ID to break the tie. The port ID is the number of the connected port.
ACN-339
Chapter 6
ACN-340
Chapter 6
Priority values 0 - 240, in increments of 16. Default port priority value is 128. The lower the port priority value, the higher the priority.
ACN-341
Chapter 6
ACN-342
Chapter 6
ACN-344
Chapter 6
ACN-345
Chapter 6
ACN-346
Chapter 6
ACN-347
Chapter 6
Cisco PortFast
Cisco has addressed this issue with their PortFast technology. The port is configured as an access port. The port transitions from blocking to forwarding state immediately, bypassing the listening and learning states. PortFast is disabled by default. It should be used only on access ports. If you enable PortFast on a port connecting to another switch, you risk creating a spanning-tree loop.
ACN-349
Chapter 6
Cisco PortFast
ACN-350
Chapter 6
ACN-351
Chapter 6
Root
Root
Chapter 6
Root
Chapter 6
Root
Root
Chapter 6
R 19
38
Root
Root
D
Root ID 32769.00A111 24577.00A333 Bridge ID 3279.00A111
ACN-356
Chapter 6
ND
Root
D
Root ID 32769.00A111 24577.00A333 Bridge ID 3279.00A111
ACN-357
Chapter 6
ND
ACN-358
Chapter 6
Root
R D D ND
D
ACN-359
R
Chapter 6
ND
ACN-360
Chapter 6
ACN-362
Chapter 6
PVST+ (Cisco)
Cisco PVST+: A network can run an STP instance for each VLAN in the network. Cisco proprietary. More than one trunk can block for a VLAN. Load sharing can be implemented. Means that all switches in the network are engaged in converging the network. Switch ports have to accommodate the additional bandwidth used for BPDUs. Default for Cisco 2960 switches.
ACN-363
Chapter 6
PVST+ (Cisco)
ACN-364
Chapter 6
PVST+ (Cisco)
Extended System-ID
ACN-365
Chapter 6
PVST+ (Cisco)
Extended System-ID
ACN-366
Chapter 6
Configure PVST+
ACN-367
Chapter 6
802.1D (STP) Switch only sends an information BPDU when it receives one on the root port.
802.1w (RSTP) Switch sends an information BPDU every hello time (2 seconds) even if no BPDU has been received on the root port.
ACN-370
Chapter 6
Non-Edge Ports: A non-edge port is a switch port that is always intended to be connected to another switch device.
ACN-372 Chapter 6
Cisco - Portfast
Edge Ports
ACN-373
Chapter 6
ACN-374
Chapter 6
ACN-375
Chapter 6
ACN-376
Chapter 6
ACN-377
Chapter 6
ACN-378
Chapter 6
RSTP
ACN-379
Chapter 6
ACN-380
Chapter 6
ACN-381
Chapter 6
ACN-382
Chapter 6
ACN-383
Chapter 6
ACN-384
Chapter 6
ACN-385
Chapter 6
ACN-386
Chapter 6
Configuring Rapid-PVST+
Rapid PVST+ is a Cisco implementation of RSTP. Supports spanning tree for each VLAN. Rapid STP variant to use in Cisco-based networks.
ACN-387
Chapter 6
ACN-388
Chapter 6
ACN-390
Chapter 6
Know the location of redundant links and which ports are blocked.
ACN-391
Chapter 6
ACN-392
Chapter 6
Core switch C1 and core switch C2 are Layer 3 switches so there is no possibility for a loop.
STP no longer blocks any single port. There is no potential for a bridging loop.
ACN-393 Chapter 6
ACN-394
Chapter 6
Fully converged. As long as S2 receives BPDUs from S3, it will block broadcasts. BROADCAST STORM! to receive For some reason, F0/3 on S2 fails BPDUs within the age time of 20 seconds. TRANSITIONS TO THE FORWARDING STATE.
ACN-395 Chapter 6
ACN-397
Chapter 6
Do not use PortFast on switch ports or interfaces that connect to other switches, hubs, or routers. You may create a network loop.
ACN-398 Chapter 6
ACN-400
Chapter 6
ACN-401
Chapter 6
Objectives
Upon completion of this chapter, student should be able to understand the followings: What is Inter-VLAN Routing? Types of Inter-VLAN Routing Configuration of Inter-VLAN Routing
ACN-402
Chapter 6
ACN-404
Chapter 6
ACN-405
Chapter 6
ACN-406
Chapter 6
ACN-407
Chapter 6
ACN-408
Chapter 6
ACN-409
Chapter 6
ACN-410
Chapter 6
ACN-412
Chapter 6
ACN-413
Chapter 6
ACN-414
Chapter 6
ACN-415
Chapter 6
ACN-417
Chapter 6
ACN-418
Chapter 6
ACN-419
Chapter 6
ACN-420
Chapter 6
Planning!
ACN-421
Chapter 6
ACN-422
Chapter 6
Inter-VLAN Routing
ACN-423
Chapter 6
ACN-424
Chapter 6
ACN-425
Chapter 6
ACN-426
Chapter 6
ACN-427
Chapter 6
VLAN 10 VLAN 30
ACN-428
Chapter 6
Inter-VLAN Routing
ACN-429
Chapter 6
ACN-430
Chapter 6
ACN-431
Chapter 6
Switch port F0/9 is Move the cable from F0/9 to F0/4. assigned to the default VLAN. One of the most common mistakes in Inter-VLAN routing.
ACN-432
Chapter 6
ACN-433
Chapter 6
Incorrect IP address for subnet 172.16.10.0/24. Incorrect IP address forfor Incorrect subnet mask subnet 172.16.10.0/24. subnet 172.16.10.0/24.
ACN-434
Chapter 6