Skip to content

Network Ninja

The Long Road to Cisco

  • Home
  • About
  • Legal Disclaimer
  • Archives

Less
More
Trim
Untrim
« Older
Home
Loading
Newer »

Archive for the 'VLAN' Category

Open Shortest Path First – OSPF Fundamentals – DR and BDR

Published
by
Deon Botha
on February 18, 2009
in BDR, BSCI, BSCI Notes, Certification, Cisco Systems, Concepts and Constructs, DR, OSPF and VLAN
. 8 Comments

When routers are connected to the same broadcast segment (I.O.W. several routers are in the same VLAN, on the same switch you getting the idea). One router is assigned the duty to maintain adjacencies with all other routers on the segment. This is the designated router (DR) and the DR  router is selected using information in the Hello messages. For redundancy purposes a backup designated router (BDR) is also elected (There is a reason for this, read on).

DRs are created on multi-access links because the number of adjacencies grows at a quadratic rate. For a network of n routers, the number of adjacencies required would be:

ospf adjacency

Two (2) routers require the following adjacencies:

ospf adjacency 2

Four (4) routers require the following adjacencies:

ospf adjacency 4

Ten (10) Routers require the following adjacencies:

ospf adjacency 45

Maintaining a OSPF segment consumes more bandwidth and requires more processing resources (CPU and memory) as more routers are added onto a OSPF network (Due to keeping the tables updated and probability of changes occuring more frequently etc).

The DR and maintaining relationships

The purpose of a DR is to be the “one router” (sounds like the matrix) to which all other routers are adjacent (the router that has all the routes on the network). Using a DR reduces the number of adjacencies that consume bandwidth and processing to n – 1 (Larger networks will however still require more processing even if you are using a DR). With a DR the adjacencies scale more effectively and efficiently with the network (as one can see in the below figure and table).

To show this in a graphic way one can see how this “adjacency” relationship works without a DR, with a DR, and with a DR and BDR with a small example network using 5 routers.

OSPF Adjacenies

Taking this a step further and plotting out the exponential growth requirements of OSPF adjacencies the table below shows the number of adjacencies needed for 1 – 10 routers (imagine the CPU and Memory requirements, not to mention the bandwidth consumption). Plan accordingly when implementing OSPF (at this point you generally use OSPF because you have a non-homogenous network environment and need the open standard because of this fact, I dont really see a point otherwise cause its such a resource hog and mission to setup).

OSPF Adjacency with DR

The job of the DR

The role of the DR is to receive updates and distribute these updates to each segment router, making sure that each router acknowledges receipt and has a synchronized copy of the Link-State Database (LSDB).

Routers advertise changes to the “AllDRs” multicast address of 224.0.0.6 where the DR then advertise the Link-State advertisements (LSAs) using the “AllSPF” multicast address 224.0.0.5 where each router then ack receipt.

The BDR listens passively to this exchange and maintains a relationship with all the routers.

If the DR stops producing hellos, the BDR promotes itself and assumes the role of DR.

NB. DRs and BDRs are only useful on multi-access links because they reduce adjacencies. The concept of a DR is not used nor usefull on point-to-point links because there can only be one adjacency.

DRs are still however elected on Point-to-Point Ethernet links (most common type of links in networking these days) which is a rather pointless and resource waste/hog (as a DR is not really needed) which is why you will find that many design guides recommend changing Ethernet links to Point-to-Point mode to stop this from happening.

If a DR fails, the BDR is pomoted. The BDR is elected on the basis of highest OSPF priority, ties in OSPF priority are broken in favour of the highest IP ADDRESS.

The default priority is 1 and a priority of 0 (zero) prevents a router from being elected to the DR or BDR role.

Priority can be set from 0-255 (manually) to change the priority from default from the interface,

Router(config-if)#ip ospf priority number

DRs  are inherently seen as stable entities  once elected into the position, even if a Router joins a network with a “greater” priority the DR will not change.

OSPF Segment with Priorities

To give an example of this an OSPF Segment with 5 Routers ( A – E, with different priorities 0 – 3). Taking what has been discussed previously A would be the DR, B the BDR, and E would never be elected. However this neglects the following set of circumstances:

Imagine the following sequence of events in this small segment,

  1. Router C starts first.
    1. Router C sends out Hellos and waits the dead time for a response from other routers.
    2. Receiving no Response, Router C conducts an Election and becomes the BDR.
    3. As there is no DR on this network, Router C then promotes itself to DR.
  2. Router E starts (priority= 0)
    1. Router E will not become the BDR due to its priority setting
  3. Router B starts and becomes the BDR.
  4. Router A starts
  5. Router D starts

In the above scenario the startup sequence of the routers caused the election of the DR and BDR (namely Router C is DR and Router B is BDR) which is not what would have been expected. This is because designated routers do not preempt, the elected DR/BDR serves in its role until reboot/failure (DR and BDR are stable entities on the network once elected).

In this network as it stands now If Router C restarts, Router B promotes itself to DR and Router A is elected BDR while C is down. If Router B goes down, Router A promotes itself and elects Router C or Router D (whichever has the highest IP Address). Finally when the BDR is rebooted, Router B wins the election for BDR.

NOTE: In addition to rebooting, clearing the OSPS process using the the command clear ip ospf process * on the DR will force the DR and BDR election.

Notes and Notices: This is a part of my personal BSCI notes and research to assist myself in learning and understanding the concepts and theory for the BSCI exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BSCI Certification.

Clearing a connected switch

Published
by
Deon Botha
on July 3, 2008
in BCMSN, Certification, Cisco Systems, Concepts and Constructs and VLAN
. 0 Comments

This is a useful thing to know in lab situations you probably won’t get this one very often in real world scenarios often (I say this because how often do you have to delete vlans and start from scratch? When the network is setup it’s just a case of small adjustments unless wholesale change is happening).

This lab assumes you have a setup like the one below and you are busy clearing settings to be able to start another lab exercise.

LAB_2

This is linked to the the previous post that dealt with how to clear an isolated switch where this post is clearing a switch connected to a larger network (if you have everything setup nicely and aren’t going to change wiring and disconnect and reconnect things because that leads to layer-1 issues).

Step 1: Telnet to the desired switch, whether that be the DSW or ASW switches of either POD 1 or POD 2. Once you have the console window open and you have privelaged level access you are ready to go.

Step 2: Delete the vlan.dat file from the switch

ASW1#delete vlan.dat
Delete filename [vlan.dat]?
Delete flash:vlan.dat? [confirm]
ASW1#

Step 3: After deleting the vlan.dat file you can delete the startup-config file

ASW1#erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]? [OK]
Erase of nvram: complete
ASW1#

Step 4: The problem with clearing a switch that is networked is that it has a tendency to relearn things (VTP) from the network. This is both a boon and a bane depending on what you want to do at the time. In this case its a bane because you want it not to do this because it makes life difficult. Issue the reload command.

ASW1(config)#reload
System configuration has been modified. Save? [yes/no] no
Proceed with reload?

After the reload has completed you check that the switch hasn’t learnt things from the network.

Switch#show vlan

If the switch shows any vlans other than VLAN 1 (default), 1002 (fddi), 1003 (token ring), 1004 (fddinet), and 1005 (trnet) then it has learnt things from the network and you have more work ahead.

If the switch only shows the VLANs above then it has been cleared and you don’t have to do anything else.

Step 5: To eliminating the vlans that the switch learnt again is simple. The switch is learning VLAN information from the network because one or more of it’s interfaces connect to an upstream VTP server. To fix this problem

Switch#conf term
Switch(config)#interface range fastethernet 0/1 - 24
Switch(config-if-range)#shutdown
Switch(config-if-range)#exit
Switch(config)#no vlan 2-xxxx
Switch(config)#exit
Switch#show vlan

The interface range command can be either fastethernet or gigabitethernet depending on the switch (you probably knew that already) and should include from port 0/1 to the last port whatever that is 8 on upwards depending on the switch chassis you have in your lab/network.

The show vlan command should output the desired vlan information and not the extra vlans at this point.

Step 6: Set the VTP mode to transparent to stop the switch from learning things again

Switch#conf term
Switch(config)#vtp mode transparent

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

Preparing a used switch for use

Published
by
Deon Botha
on July 3, 2008
in BCMSN, Cabling and Equiptment, Certification, Cisco Systems, Concepts and Constructs, SSH, Telnet and VLAN
. 1 Comment

Console Port AS

Console Port DS

Step 1: Connect a Workstation (PC or notebook) to the console port of the switch (shown above for Access layer-2 and Distribution layer-3 devices). This is the Cisco Blue cable that comes with the switches (generally a RJ-45 connector on one end and Serial connector on the other, dependant on the switch it was shipped with).

This will enable you to gain console access via Telnet or SSH into your switch. This is how configuration is done at the command line level (if you got this far without ever doing this, it’s a miracle you passed).

Step 2 :D elete the vlan.dat file

When in privaleged mode, you can type the following commands and delete the vlan.dat file
ASW1#delete vlan.dat
Delete filename [vlan.dat]?
Delete flash:vlan.dat? [confirm]
ASW1#

Step 3 :D elete the startup-config file

After erasing the vlan.dat file all vlan information is gone, now the startup config file needs to be erased as this holds VTP, interface, passwords and other information that you want to get rid of to start the switch from scratch.

ASW1#erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]? [OK]
Erase of nvram: complete
ASW1#

Step 4:Reload

After the above steps, it is now time to reload the switch

ASW1#reload
System configuration has been modified. Save? [yes/no] no
Proceed with reload?

Side Note

As a side note User-Defined VLAN setting is stored in a file on flash called vlan.dat (unix/linux based operating systems like Cisco IOS use case sensitive file naming unlike windows where a file called Aaa.dat and aaa.dat will be seen as identical.

If and when VLAN information is configured and created on a network, this vlan.dat file is used and information stored inside this file. To insert new kit or old kit into a networking (or lab) use the above steps to get rid of the file. If you have for some reason renamed the file using the below steps then you need to follow the below steps.

You can change the file-name where the vlan.dat is stored in the following way:

ASW1(config)#vtp file VLAN.dat

This command changes the vlan.dat file from vlan.dat (all lowercase) uppercase which is seen as different in IOS.

To then delete the file keep in mind that you have to keep the case sensitive spelling otherwise IOS will tell you the file doesn’t exist or delete the old file (vlan.dat) and not the new file where information is actually stored in. To delete the file:

ASW1#delete VLAN.dat

You can name the file anything you want and do pretty much anything you want on “your network”, just keep in mind that keeping things as standard and normal as possible means that if you leave your current job / position / contract the next person to work on that network is going to hate your guts if you went buck wild and creative setting up things in totally weird ways.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

BCMSN VLAN-ACL Lab 8

Published
by
Deon Botha
on June 23, 2008
in ACL, BCMSN, Certification, Cisco Systems, VACL and VLAN
. 0 Comments

LAB_2

Virtual Local Area Network (VLAN) Access Control Lists (ACL) (VACL or VLAN-ACL)

The CCNA taught ACLs standard, extended and named (standard and extended) the VACL is a standard or extended access list (no surprise) that is supported on Cisco IOS Software on Multilayer Switches (this is important) that can be mapped as the name suggests to a specific VLAN (take note).

This means that instead of an ACL filtering all traffic ingressing or egressing a particular port the ACL will filter all traffic ingressing and egressing a particular VLAN (cool huh).

The below config uses a named ACL in conjunction with the other particulars to make the VACL work. If you are rusty on the Access Lists the previous lab used an extended access list you can then also go on to try your hand at standard access lists on your own.

The aim of this lab is to block telnet, ftp, www and allow all other traffic to PC1 and PC2.

PC1 is in VLAN 10 with IP address 192.168.10.200 255.255.255.0 Default Gateway (DG) 192.168.10.1

PC2 is in VLAN 20 with IP Address 192.168.20.250 255.255.255.0 DG 192.168.10.50

Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname DSW1
Enable secret and password
DSW1(config)#enable password cisco
DSW1(config)#enable secret cisco
Setup the console port password
DSW1(config)#line con 0
DSW1(config-line)#password cisco
DSW1(config-line)#login
DSW1(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
DSW1(config)#line vty 0 4
DSW1(config-line)#password cisco
DSW1(config-line)#login
DSW1(config-line)#exit
Setup the default VLAN
DSW1(config)#interface vlan 1
DSW1(config-if)#ip address 192.168.1.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit
Setup VLAN 10
DSW1(config)#interface vlan 10
DSW1(config-if)#ip address 192.168.10.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit
Setup VLAN 20
DSW1(config)#interface vlan 20
DSW1(config-if)#ip address 192.168.20.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit
Setup Fastethernet Interfaces
DSW1(config)#interface fastethernet 0/1
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/2
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/3
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/4
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/11
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/12
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
Enable QoS Globally
DSW1(config)#mls qos
Create Access Lists
DSW1(config)#access-list 150 permit udp any any eq tftp
DSW1(config)#access-list 150 permit tcp any any eq ftp
DSW1(config)#access-list 150 permit tcp any any eq ftp-data
DSW1(config)#access-list 151 permit udp any any eq echo
DSW1(config)#access-list 151 permit udp any any eq echo-reply
DSW1(config)#access-list 151 permit udp any any eq echo
Create a class map
DSW1(config)#class-map File-Transfer
DSW1(config-cmap)#match access-group 150
DSW1(config-cmap)#exit
DSW1(config)#class-map Echo
DSW1(config-cmap)#match access-group 151
DSW1(config-cmap)#exit
Create a policy map
DSW1(config)#policy-map Precedence
DSW1(config-pmap)#class file-transfer
DSW1(config-pmap-c)#set ip precedence 5
DSW1(config-pmap-c)#exit
DSW1(config-pmap)#class echo
DSW1(config-pmap-c)#set ip precedence 1
DSW1(config-pmap-c)#exit
DSW1(config-pmap)#exit
Create a VLAN access map
DSW1(config)#vlan access-map vlan_map_10 10
DSW1(config-access-map)#match ip address blocked_protocols
DSW1(config-access-map)#action drop
DSW1(config-access-map)#exit
DSW1(config)#vlan access-map vlan_map_10 20
DSW1(config-access-map)#match ip address allowed_protocols
DSW1(config-access-map)#action forward
DSW1(config-access-map)#exit
Create an Named Extended Access List
DSW1(config)#ip access-list extended blocked_protocols
DSW1(config-ext-ipacl)#permit tcp any any eq telnet
DSW1(config-ext-ipacl)#permit tcp any any eq ftp
DSW1(config-ext-ipacl)#permit tcp any any eq ftp-data
DSW1(config-ext-ipacl)#permit tcp any any eq www
DSW1(config-ext-ipacl)#exit
DSW1(config)#ip access-list extended allowed_protocols
DSW1(config-ext-ipacl)#permit ip any any
DSW1(config-ext-ipacl)#exit
Apply the VLAN ACL to Filter a VLAN
DSW1(config)#vlan filter vlan_map_10 vlan-list 10
Associate VLANs with Fe 1 to 4
DSW1(config)#interface range fastethernet 0/1 - 4
DSW1(config-if-range)#speed 100
DSW1(config-if-range)#duplex auto
DSW1(config-if-range)#switchport
DSW1(config-if-range)#switchport trunk encapsulation dot1q
DSW1(config-if-range)#switchport trunk native vlan 1
DSW1(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW1(config-if-range)#switchport mode trunk
Apply QoS Policy
DSW1(config-if-range)#service-policy input precedence
DSW1(config-if-range)#exit
Associate VLANs with Fe 11 and 12
DSW1(config)#interface range fastethernet 0/11 - 12
DSW1(config-if-range)#speed 100
DSW1(config-if-range)#duplex auto
DSW1(config-if-range)#switchport
DSW1(config-if-range)#switchport trunk encapsulation dot1q
DSW1(config-if-range)#switchport trunk native vlan 1
DSW1(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW1(config-if-range)#switchport mode trunk
DSW1(config-if-range)#exit
Aministratively shutdown all ports not connected
DSW1(config)#interface range fastethernet 0/5 - 10
DSW1(config-if-range)#shut
DSW1(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
DSW1(config)#spanning-tree vlan 1 root primary
DSW1(config)#spanning-tree vlan 10 root primary
DSW1(config)#spanning-tree vlan 20 root secondary
Enable Routing and a Protocol
DSW1(config)#ip routing
DSW1(config)#router eigrp 100
DSW1(config-router)#network 192.168.0.0
DSW1(config-router)#exit
Exit Global Configuration Mode
DSW1(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
DSW1#show interfaces status
Check that you configured STP
DSW1#show spanning-tree
Check routing is correct
DSW1#show ip route
Check QoS is enabled
DSW1#show mls qos
Check Access Lists
DSW1#show access-lists
Check class maps
DSW1#show class-map
Check policy map
DSW1#show policy-map
Check that QoS is applied to the interfaces
DSW1#show run | begin interface FastEthernet 0/1
Check VLAN Access-Map
DSW1#show vlan access-map
Confirm Named Access lists
DSW1#show access-lists blocked_protocols
DSW1#show access-lists allowed_protocols
DSW1#show access-lists
Confirm VLAN filter
DSW1#show vlan filter
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
DSW1#copy run start

Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname DSW2
Enable secret and password
DSW2(config)#enable password cisco
DSW2(config)#enable secret cisco
Setup the console port password
DSW2(config)#line con 0
DSW2(config-line)#password cisco
DSW2(config-line)#login
DSW2(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
DSW2(config)#line vty 0 4
DSW2(config-line)#password cisco
DSW2(config-line)#login
DSW2(config-line)#exit
Setup the default VLAN
DSW2(config)#interface vlan 1
DSW2(config-if)#ip address 192.168.1.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit
Setup VLAN 10
DSW2(config)#interface vlan 10
DSW2(config-if)#ip address 192.168.10.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit
Setup VLAN 20
DSW2(config)#interface vlan 20
DSW2(config-if)#ip address 192.168.20.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit
Setup Fastethernet Interfaces
DSW2(config)#interface fastethernet 0/1
DSW2(config-if)#description DSW2 - ASW2
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/2
DSW2(config-if)#description DSW2 - ASW2
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/3
DSW2(config-if)#description DSW2 - ASW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/4
DSW2(config-if)#description DSW2 - ASW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/11
DSW2(config-if)#description DSW2 - DSW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/12
DSW2(config-if)#description DSW2 - DSW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
Enable QoS Globally
DSW2(config)#mls qos
Create Access Lists
DSW2(config)#access-list 150 permit udp any any eq tftp
DSW2(config)#access-list 150 permit tcp any any eq ftp
DSW2(config)#access-list 150 permit tcp any any eq ftp-data
DSW2(config)#access-list 151 permit udp any any eq echo
DSW2(config)#access-list 151 permit udp any any eq echo-reply
DSW2(config)#access-list 151 permit udp any any eq echo
Create a class map
DSW2(config)#class-map File-Transfer
DSW2(config-cmap)#match access-group 150
DSW2(config-cmap)#exit
DSW2(config)#class-map Echo
DSW2(config-cmap)#match access-group 151
DSW2(config-cmap)#exit
Create a policy map
DSW2(config)#policy-map Precedence
DSW2(config-pmap)#class file-transfer
DSW2(config-pmap-c)#set ip precedence 5
DSW2(config-pmap-c)#exit
DSW2(config-pmap)#class echo
DSW2(config-pmap-c)#set ip precedence 1
DSW2(config-pmap-c)#exit
DSW2(config-pmap)#exit
Create a VLAN access map
DSW2(config)#vlan access-map vlan_map_20 10
DSW2(config-access-map)#match ip address blocked_protocols
DSW2(config-access-map)#action drop
DSW2(config-access-map)#exit
DSW2(config)#vlan access-map vlan_map_20 20
DSW2(config-access-map)#match ip address allowed_protocols
DSW2(config-access-map)#action forward
DSW2(config-access-map)#exit
Create an Named Extended Access List
DSW2(config)#ip access-list extended blocked_protocols
DSW2(config-ext-ipacl)#permit tcp any any eq telnet
DSW2(config-ext-ipacl)#permit tcp any any eq ftp
DSW2(config-ext-ipacl)#permit tcp any any eq ftp-data
DSW2(config-ext-ipacl)#permit tcp any any eq www
DSW2(config-ext-ipacl)#exit
DSW2(config)#ip access-list extended allowed_protocols
DSW2(config-ext-ipacl)#permit ip any any
DSW2(config-ext-ipacl)#exit
Apply the VLAN ACL to Filter a VLAN
DSW2(config)#vlan filter vlan_map_20 vlan-list 20
Associate VLANs with Fe 1 to 4
DSW2(config)#interface range fastethernet 0/1 - 4
DSW2(config-if-range)#speed 100
DSW2(config-if-range)#duplex auto
DSW2(config-if-range)#switchport
DSW2(config-if-range)#switchport trunk encapsulation dot1q
DSW2(config-if-range)#switchport trunk native vlan 1
DSW2(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW2(config-if-range)#switchport mode trunk
Apply QoS Policy
DSW2(config-if-range)#service-policy input precedence
DSW2(config-if-range)#exit
Associate VLANs with Fe 11 and 12
DSW2(config)#interface range fastethernet 0/11 - 12
DSW2(config-if-range)#speed 100
DSW2(config-if-range)#duplex auto
DSW2(config-if-range)#switchport
DSW2(config-if-range)#switchport trunk encapsulation dot1q
DSW2(config-if-range)#switchport trunk native vlan 1
DSW2(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW2(config-if-range)#switchport mode trunk
DSW2(config-if-range)#exit
Aministratively shutdown all ports not connected
DSW2(config)#interface range fastethernet 0/5 - 10
DSW2(config-if-range)#shut
DSW2(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
DSW2(config)#spanning-tree vlan 1 root secondary
DSW2(config)#spanning-tree vlan 10 root secondary
DSW2(config)#spanning-tree vlan 20 root primary
Enable Routing and a Protocol
DSW2(config)#ip routing
DSW2(config)#router eigrp 100
DSW2(config-router)#network 192.168.0.0
DSW2(config-router)#exit
Exit Global Configuration Mode
DSW2(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
DSW2#show interfaces status
Check that you configured STP
DSW2#show spanning-tree
Check routing is correct
DSW2#show ip route
Check QoS is enabled
DSW2#show mls qos
Check Access Lists
DSW2#show access-lists
Check class maps
DSW2#show class-map
Check policy map
DSW2#show policy-map
Check that QoS is applied to the interfaces
DSW2#show run | begin interface FastEthernet 0/1
Check VLAN Access-Map
DSW2#show vlan access-map
Confirm Named Access lists
DSW2#show access-lists blocked_protocols
DSW2#show access-lists allowed_protocols
DSW2#show access-lists
Confirm VLAN filter
DSW2#show vlan filter
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
DSW2#copy run start

Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname ASW1
Enable secret and password
ASW1(config)#enable password cisco
ASW1(config)#enable secret cisco
Setup the console port password
ASW1(config)#line con 0
ASW1(config-line)#password cisco
ASW1(config-line)#login
ASW1(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
ASW1(config)#line vty 0 4
ASW1(config-line)#password cisco
ASW1(config-line)#login
ASW1(config-line)#exit
Default Gateway
ASW1(config-line)#ip default-gateway 192.168.1.1
Setup the default VLAN
ASW1(config)#interface vlan 1
ASW1(config-if)#ip address 192.168.1.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup VLAN 10
ASW1(config)#interface vlan 10
ASW1(config-if)#ip address 192.168.10.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup VLAN 20
ASW1(config)#interface vlan 20
ASW1(config-if)#ip address 192.168.20.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup Fastethernet Interfaces
ASW1(config)#interface fastethernet 0/1
ASW1(config-if)#description ASW1 - DSW1
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/2
ASW1(config-if)#description ASW1 - DSW1
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/3
ASW1(config-if)#description ASW1 - DSW2
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/4
ASW1(config-if)#description ASW1 - DSW2
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface
ASW1(config)#interface fastethernet 0/12
ASW1(config-if)#description ASW1 - PC1
ASW1(config-if)#speed 10
ASW1(config-if)#duplex half
ASW1(config-if)#switchport
Make the port as an access port
ASW1(config-if)#switchport mode access
Make the port an access port for VLAN 10
ASW1(config-if)#switchport access vlan 10
Enable PortFast on end-points
ASW1(config-if)#spanning-tree portfast
ASW1(config-if)#no shut
ASW1(config-if)#exit
Associate VLANs with Fe 1 to 4
ASW1(config)#interface range fastethernet 0/1 - 4
ASW1(config-if-range)#speed 100
ASW1(config-if-range)#duplex auto
ASW1(config-if-range)#switchport
ASW1(config-if-range)#switchport trunk encapsulation dot1q
ASW1(config-if-range)#switchport trunk native vlan 1
ASW1(config-if-range)#switchport trunk allowed vlan 1,20,10
ASW1(config-if-range)#switchport mode trunk
Configure UplinkFast
ASW1(config-if-range)#spanning-tree uplinkfast
ASW1(config-if-range)#exit
Aministratively shutdown all ports not connected
ASW1(config)#interface range fastethernet 0/5 - 11
ASW1(config-if-range)#shut
ASW1(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
ASW1(config)#spanning-tree vlan 1
ASW1(config)#spanning-tree vlan 10
ASW1(config)#spanning-tree vlan 20
Exit Global Configuration Mode
ASW1(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
ASW1#show interfaces status
Check that you configured STP
DSW1#show spanning-tree
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
ASW1#copy run start

Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname ASW2
Enable secret and password
ASW2(config)#enable password cisco
ASW2(config)#enable secret cisco
Setup the console port password
ASW2(config)#line con 0
ASW2(config-line)#password cisco
ASW2(config-line)#login
ASW2(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
ASW2(config)#line vty 0 4
ASW2(config-line)#password cisco
ASW2(config-line)#login
ASW2(config-line)#exit
Default Gateway
ASW2(config-line)#ip default-gateway 192.168.1.50
Setup the default VLAN
ASW2(config)#interface vlan 1
ASW2(config-if)#ip address 192.168.1.150 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup VLAN 10
ASW2(config)#interface vlan 10
ASW2(config-if)#ip address 192.168.10.150 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup VLAN 20
ASW2(config)#interface vlan 20
ASW2(config-if)#ip address 192.168.20.150 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup Fastethernet Interfaces
ASW2(config)#interface fastethernet 0/1
ASW2(config-if)#description ASW2 - DSW2
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/2
ASW2(config-if)#description ASW2 - DSW2
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/3
ASW2(config-if)#description ASW2 - DSW1
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/4
ASW2(config-if)#description ASW2 - DSW1
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface
ASW2(config)#interface fastethernet 0/12
ASW2(config-if)#description ASW2 - PC2
ASW2(config-if)#speed 10
ASW2(config-if)#duplex half
ASW2(config-if)#switchport
Make the port as an access port
ASW2(config-if)#switchport mode access
Make the port an access port for VLAN 20
ASW2(config-if)#switchport access vlan 20
Enable PortFast on end-points
ASW2(config-if)#spanning-tree portfast
ASW2(config-if)#no shut
ASW2(config-if)#exit
Associate VLANs with Fe 1 to 4
ASW2(config)#interface range fastethernet 0/1 - 4
ASW2(config-if-range)#speed 100
ASW2(config-if-range)#duplex auto
ASW2(config-if-range)#switchport
ASW2(config-if-range)#switchport trunk encapsulation dot1q
ASW2(config-if-range)#switchport trunk native vlan 1
ASW2(config-if-range)#switchport trunk allowed vlan 1,20,10
ASW2(config-if-range)#switchport mode trunk
Configure UplinkFast
ASW2(config-if-range)#spanning-tree uplinkfast
ASW2(config-if-range)#exit
Aministratively shutdown all ports not connected
ASW2(config)#interface range fastethernet 0/5 - 10
ASW2(config-if-range)#shut
ASW2(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
ASW2(config)#spanning-tree vlan 1
ASW2(config)#spanning-tree vlan 10
ASW2(config)#spanning-tree vlan 20
Exit Global Configuration Mode
ASW2(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
ASW2#show interfaces status
Check that you configured STP
ASW2#show spanning-tree
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
ASW2#copy run start

The end result of this will be if you attempt to for example telnet from one of the ASW switches to the PCs (1 or 2) you should get the following:

ASW1#telnet 192.168.10.200
Trying 192.168.10.200 ...
% Connection timed out; remote host not responding

Still trying to sort out LAB time so will test this out and update as needed.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

BCMSN VLAN-ing Lab 2

Published
by
Deon Botha
on June 10, 2008
in BCMSN, Certification, Cisco Systems, Concepts and Constructs and VLAN
. 1 Comment

LAB 1 BCMSN

The way of the VLAN

Looking back over the previous config done on the switches you will remember that all switches were part of VLAN 1 (default vlan). If you don’t know this or know where I pulled this information from issue this command:

ASW1#show interfaces status

The output will show interface, the description of the interface, status, VLAN, duplex, speed and the type of connection (all connections by default unless told otherwise belong to the default VLAN iow VLAN 1)

To practice VLANs I am going to change some information from the initial config and add VLANs.

I am a glutton for punishment, I retype and redo all configurations when I am practising for an exam from scratch (I don’t run from saved, I redo). Try it, it’s a pain in the backside and takes longer but it means that you are forced to type the commands one at a time from memory (don’t take a shortcut and use notepad either, type each command, move between interfaces, keep track which interfaces you have completed and which you still have to do). It pays off at the end of the day and helps you logically organize how you configure IRL (In Real Life).

Distribution Switch 1

Step 1: Setup the basics all of the following is CCNA level stuff and should easy if not second nature. This is to get the security and host name down before going onto the interface configuration.

Enter Privileged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname DSW1
Enable secret and password
DSW1(config)#enable secret ciscosystems
DSW1(config)#enable password cisco
Setup a local user database
DSW1(config)#username admin@mydomain.com privilege 15 password cisco
Setup the console port password
DSW1(config)#line con 0
DSW1(config-line)#login local
DSW1(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
DSW1(config)#line vty 0 4
DSW1(config-line)#password cisco
DSW1(config-line)#login
DSW1(config-line)#exit
Setup the Auxiliary Password
DSW1(config)#line aux 0
DSW1(config-line)#no exec
DSW1(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch
DSW1(config)#interface vlan 1
DSW1(config-if)#ip address 192.168.1.1 255.255.255.0
NB I am shutting the interface
DSW1(config-if)#shut
DSW1(config-if)#exit

Step 3: Setup other interfaces

Setup Fastethernet Interfaces
DSW1(config)#interface fastethernet 0/1
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#speed 100
DSW1(config-if)#duplex auto
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/2
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#speed 100
DSW1(config-if)#duplex auto
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/3
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#speed 100
DSW1(config-if)#duplex auto
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/4
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#speed 100
DSW1(config-if)#duplex auto
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/11
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#speed 100
DSW1(config-if)#duplex auto
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/12
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#speed 100
DSW1(config-if)#duplex auto
DSW1(config-if)#no shut
DSW1(config-if)#exit

Alternatively use range command

Setup Fastethernet Interfaces
DSW1(config)#interface fastethernet 0/1
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/2
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/3
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/4
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#exit
DSW1(config)#interface range fastethernet 0/1 - 4
DSW1(config-if-range)#speed 100
DSW1(config-if-range)#duplex auto
DSW1(config-if-range)#no shut
DSW1(config-if-range)#exit
DSW1(config)#interface fastethernet 0/11
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/12
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#exit
DSW1(config)#interface range fastethernet 0/11 - 12
DSW1(config-if-range)#speed 100
DSW1(config-if-range)#duplex auto
DSW1(config-if-range)#no shut
DSW1(config-if-range)#exit

Step 4: Associate a VLAN with the Interfaces

Create and Associate VLAN 100 with Fe 1 to 4
DSW1(config)#interface range fastethernet 0/1 - 4
DSW1(config-if-range)#switchport
DSW1(config-if-range)#switchport mode access
DSW1(config-if-range)#switchport access vlan 100
%Access VLAN does not exist. Creating vlan 100
DSW1(config-if-range)#exit
Associate VLAN 100 with Fe 11 and 12
DSW1(config)#interface range fastethernet 0/11 - 12
DSW1(config-if-range)#switchport
DSW1(config-if-range)#switchport mode access
DSW1(config-if-range)#switchport access vlan 100
DSW1(config-if-range)#exit

Step 5: Assign an ip address to the new VLAN to ping

Setup the VLAN ip address
DSW1(config)#interface vlan 100
DSW1(config-if)#ip address 192.168.100.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit

Step 6: Shut down non-used interfaces

Administratively shut down all ports not connected
DSW1(config)#interface range fastethernet 0/5 - 10
DSW1(config-if-range)#shut
DSW1(config-if-range)#exit
Exit Global Configuration Mode
DSW1(config)#exit

Step 7: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
DSW1#show interfaces status
show the vlans that are configured
DSW1#show vlan
show switchport you can change the fastethernet 0/4 for any active port for information
DSW1#show interface fasthethernet 0/4 switchport
show run the running configuration
DSW1#show run

Step 8: Save your work

Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)... oops copy start run
DSW1#copy run start

Distribution Switch 2

Step 1: Setup the basics all of the following is CCNA level stuff and should easy if not second nature. This is to get the security and host name down before going onto the interface configuration.

Enter Privileged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname DSW2
Enable secret and password
DSW2(config)#enable secret cisco
DSW2(config)#enable password cisco
Setup a local user database
DSW2(config)#username admin@mydomain.com privilege 15 password cisco
Setup the console port password
DSW2(config)#line con 0
DSW2(config-line)#login local
DSW2(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
DSW2(config)#line vty 0 4
DSW2(config-line)#password cisco
DSW2(config-line)#login
DSW2(config-line)#exit
Setup the Auxiliary Password
DSW2(config)#line aux 0
DSW2(config-line)#no exec
DSW2(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch
DSW2(config)#interface vlan 1
DSW2(config-if)#ip address 192.168.1.50 255.255.255.0
NB I am shutting the interface
DSW2(config-if)#shut
DSW2(config-if)#exit

Step 3: Setup other interfaces

Setup Fastethernet Interfaces
DSW2(config)#interface fastethernet 0/1
DSW2(config-if)#description DSW2 - ASW2
DSW2(config-if)#speed 100
DSW2(config-if)#duplex auto
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/2
DSW2(config-if)#description DSW2 - ASW2
DSW2(config-if)#speed 100
DSW2(config-if)#duplex auto
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/3
DSW2(config-if)#description DSW2 - ASW1
DSW2(config-if)#speed 100
DSW2(config-if)#duplex auto
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/4
DSW2(config-if)#description DSW2 - ASW1
DSW2(config-if)#speed 100
DSW2(config-if)#duplex auto
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/11
DSW2(config-if)#description DSW2 - DSW1
DSW2(config-if)#speed 100
DSW2(config-if)#duplex auto
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/12
DSW2(config-if)#description DSW2 - DSW1
DSW2(config-if)#speed 100
DSW2(config-if)#duplex auto
DSW2(config-if)#no shut
DSW2(config-if)#exit

Alternatively use range command

Setup Fastethernet Interfaces
DSW2(config)#interface fastethernet 0/1
DSW2(config-if)#description DSW1 - ASW1
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/2
DSW2(config-if)#description DSW1 - ASW1
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/3
DSW2(config-if)#description DSW1 - ASW2
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/4
DSW2(config-if)#description DSW1 - ASW2
DSW2(config-if)#exit
DSW2(config)#interface range fastethernet 0/1 - 4
DSW2(config-if-range)#speed 100
DSW2(config-if-range)#duplex auto
DSW2(config-if-range)#no shut
DSW2(config-if-range)#exit
DSW2(config)#interface fastethernet 0/11
DSW2(config-if)#description DSW1 - DSW2
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/12
DSW2(config-if)#description DSW1 - DSW2
DSW2(config-if)#exit
DSW2(config)#interface range fastethernet 0/11 - 12
DSW2(config-if-range)#speed 100
DSW2(config-if-range)#duplex auto
DSW2(config-if-range)#no shut
DSW2(config-if-range)#exit

Step 4: Associate a VLAN with the Interfaces

Create and Associate VLAN 100 with Fe 1 to 4
DSW2(config)#interface range fastethernet 0/1 - 4
DSW2(config-if-range)#switchport
DSW2(config-if-range)#switchport mode access
DSW2(config-if-range)#switchport access vlan 100
%Access VLAN does not exist. Creating vlan 100
DSW2(config-if-range)#exit
Associate VLAN 100 with Fe 11 and 12
DSW2(config)#interface range fastethernet 0/11 - 12
DSW2(config-if-range)#switchport
DSW2(config-if-range)#switchport mode access
DSW2(config-if-range)#switchport access vlan 100
DSW2(config-if-range)#exit

Step 5: Assign an ip address to the new VLAN to ping

Setup the VLAN ip address
DSW2(config)#interface vlan 100
DSW2(config-if)#ip address 192.168.100.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit

Step 6: Shut down non-used interfaces

Aministratively shutdown all ports not connected
DSW2(config)#interface range fastethernet 0/5 - 10
DSW2(config-if-range)#shut
DSW2(config-if-range)#exit
Exit Global Configuration Mode
DSW2(config)#exit

Step 7: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
DSW2#show interfaces status
show the vlans that are configured
DSW2#show vlan
show switchport you can change the fastethernet 0/4 for any active port for information
DSW2#show interface fasthethernet 0/4 switchport
show run the running configuration
DSW2#show run

Step 8: Save your work

Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)... oops copy start run
DSW2#copy run start

Access Switch 1

Step 1: Setup the basics all of the following is CCNA level stuff and should easy if not second nature. This is to get the security and host name down before going onto the interface configuration.

Enter Privileged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname ASW1
Enable secret and password
ASW1(config)#enable secret cisco
ASW1(config)#enable password cisco
Setup a local user database
ASW1(config)#username admin@mydomain.com privilege 15 password cisco
Setup the console port password
ASW1(config)#line con 0
ASW1(config-line)#login local
ASW1(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
ASW1(config)#line vty 0 4
ASW1(config-line)#password cisco
ASW1(config-line)#login
ASW1(config-line)#exit
Setup the Auxiliary Password
ASW1(config)#line aux 0
ASW1(config-line)#no exec
ASW1(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch
ASW1(config)#interface vlan 1
ASW1(config-if)#ip address 192.168.1.100 255.255.255.0
NB I am shutting the interface
ASW1(config-if)#shut
ASW1(config-if)#exit

Step 3: Assign an ip address to the new VLAN to ping

Create VLAN 100 and Configure Interface
ASW1(config)#vlan 100 name Marketing
ASW1(config)#interface vlan 100
ASW1(config-if)#ip address 192.168.100.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit

Step 4: Setup other interfaces

Setup Fastethernet Interfaces
ASW1(config)#interface fastethernet 0/1
ASW1(config-if)#description ASW1 - DSW1
ASW1(config-if)#speed 100
ASW1(config-if)#duplex auto
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/2
ASW1(config-if)#description ASW1 - DSW1
ASW1(config-if)#speed 100
ASW1(config-if)#duplex auto
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/3
ASW1(config-if)#description ASW1 - DSW2
ASW1(config-if)#speed 100
ASW1(config-if)#duplex auto
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/4
ASW1(config-if)#description ASW1 - DSW2
ASW1(config-if)#speed 100
ASW1(config-if)#duplex auto
ASW1(config-if)#no shut
ASW1(config-if)#exit

Alternatively use the range command

Setup Fastethernet Interfaces
ASW1(config)#interface fastethernet 0/1
ASW1(config-if)#description DSW1 - ASW1
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/2
ASW1(config-if)#description DSW1 - ASW1
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/3
ASW1(config-if)#description DSW1 - ASW2
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/4
ASW1(config-if)#description DSW1 - ASW2
ASW1(config-if)#exit
ASW1(config)#interface range fastethernet 0/1 - 4
ASW1(config-if-range)#speed 100
ASW1(config-if-range)#duplex auto
ASW1(config-if-range)#no shut
ASW1(config-if-range)#exit

Step 5: This is where the ASW and the DSW switches differ. This connects to the Workstation end-point where the DSW switches use port 11/12 to provide failover for the distribution

Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface
ASW1(config)#interface fastethernet 0/12
ASW1(config-if)#description ASW1 - PC1
ASW1(config-if)#speed 10
ASW1(config-if)#duplex half
ASW1(config-if)#switchport
Make the port as an access port
ASW1(config-if)#switchport mode access
Make the port an access port for VLAN 100
ASW1(config-if)#switchport access vlan 100
ASW1(config-if)#no shut
ASW1(config-if)#exit

Step 6: Associate a VLAN with the Interfaces

Associate VLAN 100 with Fe 1 to 4
ASW1(config)#interface range fastethernet 0/1 - 4
ASW1(config-if-range)#switchport
ASW1(config-if-range)#switchport mode access
ASW1(config-if-range)#switchport access vlan 100
ASW1(config-if-range)#exit

Step 7: Shut down non-used interfaces

Administratively shut down all ports not connected
ASW1(config)#interface range fastethernet 0/5 - 11
ASW1(config-if-range)#shut
ASW1(config-if-range)#exit
Exit Global Configuration Mode
ASW1(config)#exit

Step 8: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
ASW1#show interfaces status
show the vlans that are configured
ASW1#show vlan
show switchport you can change the fastethernet 0/4 for any active port for information
ASW1#show interface fasthethernet 0/4 switchport
show run the running configuration
ASW1#show run

Step 9: Save your work

Copy the running configuration to the startup configuration. I got in the bad habit to do this the other way around for a while (did it in an exam)... oops copy start run
ASW1#copy run start

Access Switch 2

Step 1: Setup the basics all of the following is CCNA level stuff and should easy if not second nature. This is to get the security and host name down before going onto the interface configuration.

Enter Privileged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname ASW2
Enable secret and password
ASW2(config)#enable secret cisco
ASW2(config)#enable password cisco
Setup a local user database
ASW2(config)#username admin@mydomain.com privilege 15 password cisco
Setup the console port password
Setup the console port password
ASW2(config)#line con 0
ASW2(config-line)#login local
ASW2(config-line)#exit
Setup the Auxiliary Password
ASW2(config)#line aux 0
ASW2(config-line)#no exec
ASW2(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
ASW2(config)#line vty 0 4
ASW2(config-line)#password cisco
ASW2(config-line)#login
ASW2(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch
ASW2(config)#interface vlan 1
ASW2(config-if)#ip address 192.168.1.200 255.255.255.0
NB I am shutting the interface
ASW2(config-if)#shut
ASW2(config-if)#exit

Step 3: Assign an ip address to the new VLAN to ping

Create VLAN 100 and Configure Interface
ASW2(config)#vlan 100 name Marketing
ASW2(config)#interface vlan 100
ASW2(config-if)#ip address 192.168.100.200 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit

Step 4: Setup other interfaces

Setup Fastethernet Interfaces
ASW2(config)#interface fastethernet 0/1
ASW2(config-if)#description ASW2 - DSW2
ASW2(config-if)#speed 100
ASW2(config-if)#duplex auto
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/2
ASW2(config-if)#description ASW2 - DSW2
ASW2(config-if)#speed 100
ASW2(config-if)#duplex auto
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/3
ASW2(config-if)#description ASW2 - DSW1
ASW2(config-if)#speed 100
ASW2(config-if)#duplex auto
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/4
ASW2(config-if)#description ASW2 - DSW1
ASW2(config-if)#speed 100
ASW2(config-if)#duplex auto
ASW2(config-if)#no shut
ASW2(config-if)#exit

Alternatively use the range command

Setup Fastethernet Interfaces
ASW2(config)#interface fastethernet 0/1
ASW2(config-if)#description DSW1 - ASW1
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/2
ASW2(config-if)#description DSW1 - ASW1
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/3
ASW2(config-if)#description DSW1 - ASW2
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/4
ASW2(config-if)#description DSW1 - ASW2
ASW2(config-if)#exit
ASW2(config)#interface range fastethernet 0/1 - 4
ASW2(config-if-range)#speed 100
ASW2(config-if-range)#duplex auto
ASW2(config-if-range)#no shut
ASW2(config-if-range)#exit

Step 5: This is where the ASW and the DSW switches differ. This connects to the Workstation end-point where the DSW switches use port 11/12 to provide failover for the distribution

Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface
ASW2(config)#interface fastethernet 0/12
ASW2(config-if)#description ASW2 - PC2
ASW2(config-if)#speed 10
ASW2(config-if)#duplex half
ASW1(config-if)#switchport
Make the port as an access port
ASW2(config-if)#switchport mode access
Make the port an access port for VLAN 100
ASW2(config-if)#switchport access vlan 100
ASW2(config-if)#no shut
ASW2(config-if)#exit

Step 6: Associate a VLAN with the Interfaces

Associate VLAN 100 with Fe 1 to 4
ASW2(config)#interface range fastethernet 0/1 - 4
ASW1(config-if-range)#switchport
ASW1(config-if-range)#switchport mode access
ASW2(config-if-range)#switchport access vlan 100
ASW2(config-if-range)#exit

Step 7: Shut down non-used interfaces

Administratively shut down all ports not connected
ASW2(config)#interface range fastethernet 0/5 - 11
ASW2(config-if-range)#shut
ASW2(config-if-range)#exit
Exit Global Configuration Mode
ASW2(config)#exit

Step 5: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
ASW2#show interfaces status
show the vlans that are configured
ASW2#show vlan
show switchport you can change the fastethernet 0/4 for any active port for information
ASW2#show interface fasthethernet 0/4 switchport
show run the running configuration
ASW2#show run

Step 6: Save your work

Copy the running configuration to the startup configuration. I got in the bad habit to do this the other way around for a while (did it in an exam)... oops copy start run
ASW2#copy run start

This lab is pretty much exactly the same as the previous lab except for the small changes to VLAN 1 and the addition of VLAN 100. Other noteworthy changes would be the use of switchport access commands.

The object would be to be able to ping the various VLAN 100 interface ip addresses. There may be certain restrictions to what you can ping but as long as directly connected switches can ping the VLAN 100 interfaces you have VLAN 100 up and running.

Post Scriptum

I am going to assume* that if one telnets into a switch/router using the vlan 1 then go onto shut vlan 1 the session will be dropped (it will make sense if that were to happen). So I am going to assume you would have to use the Console connection to do this.

One can automate to an extent the speed and duplex commands with the interface range command for this lab, I just need to get into the habit of adding a description to my interfaces (don’t do that because I know what the interface are and do when setting it up, troubleshooting 6 months later I have found it to be another matter).

Also you can use the following to shorten what you have to type every time :-
ASW2(config)#define interface range OnetoFour fe 0/1, fe 0/2, fe 0/3, fe 0/4
ASW2(config)#interface range macro OnetoFour

*The say assumption is the mother of all f-ups. Until I have arranged lab time I am going to go on my assumptions because I want to test and see if this is the case.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

Switch Security Layer-2 Attacks – Two

Published
by
Deon Botha
on May 27, 2008
in ACL, BCMSN, Certification, Cisco Systems, Concepts and Constructs, Switch Spoofing, Trunk, VACL, VLAN and VLAN Hopping
. 2 Comments

VLAN-Attack

VLAN Hopping

VLAN Hopping is a network attack whereby an end-device sends packets to/or collects packets from a VLAN that should not be accessible to that end-device. This is done by tagging the invasive traffic with a specific VLAN ID (VID) or by negotiating a trunk link to send or receive traffic on penetrated VLANs. VLAN hopping can be done by switch spoofing or double tagging.

In a Switch spoofing attack the attacker configures an end-device to spoof itself as a switch (this can be a linux pc). The attack emulates Inter-Switch Link (ISL) or 802.1Q signaling along with Dynamic Trunk Protocol (DTP). This is signaling to attempt to establishing a trunk connection with the company switch.

Any switch port configured with DTP auto, upon receipt of a DTP packet generated by the attacking device, will become a trunk port and then accept traffic destined for any VLAN supported on any trunk on that link. The attacker can then send/collect packets from/to any VLAN.

Double Tagging is another method of VLAN Hopping, this is when a workstation generates frames for two 802.1Q headers, this causes the switch to forward the frames onto a VLAN that would normally be inaccessible to the attacker through legitimate means.

The first switch to encounter the double tagged 802.1Q frame strips the first header frame (native VLAN), and forwards the frame out a trunk link, the second switch then forwards the frame according to the other 802.1Q frame header. Should the tag not match the native VLAN of the attacker, the frame will go untagged and flooded to only the original frame.

Best Practices to Mitigate VLAN Hopping

  • Configure all unused ports as access ports so that trunking cannot be negotiated across those links.
  • Place all unused ports in the shutdown state and associate them with a VLAN designed for only unused ports, carrying no user data traffic (that means not the Native VLAN either).
  • When establishing a trunk link, purposefully configure arguments so that:
    • The native VLAN will be different form any data VLANs
    • Trunking is set up as “on” rather than as negotiated.
    • The specific VLAN range will be carried on the trunk

Configuration
To Mitigate against VLAN hopping attacks the following is the config. First select a range of interfaces:
switch#configure terminal
switch(config)#interface range gigabitethernet 0/1-48

Now configure the ports as access ports this in turn will turn off DTP

switch(config-if)#switchport mode access

Assign the ports to an unused VLAN (not the Native VLAN)

switch(config-if)#switchport access vlan vlan-id

NB the above commands will not work in VoIP (voice) networks. Cisco IP Phones use trunks (DTP).

VLAN Access Control Lists

There are three kinds of ACLs:

  • Router Access Control Lists (RACLs)supported in the TCAM hardware on Cisco Multi-layer switches (MLS). Can be applied to any router interface, such as a switch virtual interface (SVI) or Layer 3 routed port.
  • Port Access Control List (PACL)filters traffic at the port level. PACLs can be applied on a Layer-2 switch port, trunk port, or EtherChannel port.
  • Vlan Access Control Lists (VACLs)(a.k.a VLAN Access Maps) supported on software on Cisco MLS.

Cisco Catalyst switches support four ACL lookups per packet*:

  • ingress (1) and egress (2) security lookup
  • ingress (3) and egress (4) Quality of Service (QoS) look-up

This following section all went over my head or just about and I have no idea whether this works or not or is correct or not for more information.

There are cases where certain Access Control Entries (ACEs) must be combined in each ACLs due to limitations of TCAM hardware. The merge process is also responsible for other functions like expanding ACEs due to a lack of Layer 4 Operations Pointers (L4Op Pointers) or Logical Operational Units (LOUs).

Cisco catalyst Switches use two features to perform a merge

  • order independent algorithm merge
  • order dependant algorithm merge

Order Independent Merge (OIM) is based on Binary Decision Diagrams(BDD), ACLs are merged from a series of oder-dependant actions to a set of order-independent masks and patterns. The resulting ACE can be very large, and processor and memory intensive.

Order Dependant Merge (ODM) is not bit-based. The computation is much faster and is less processor intensive.

RACLs are supported in hardware through IP standard and IP extended ACSs, with permit and deny actions. ACL processing is an intrinsic part of the packet forwarding process. ACL entries are programmed in hardware. Lookups occur in the pipeline, whether ACLs are configured or not. With RACLs access list statistics and logging are not supported.

*You can get some switches with two security lookups and 1 QoS lookup in each direction (6 total).

Configuring VACLs

VACLs apply to all traffic on a VLAN. VACLs use standard and extended Cisco IOS IP and IPX ACLs, and MAC Layer-named ACLs and VLAN access-maps.

VACLs follow route-map conventions, in which map sequences are check in order (top-down).

Each VLAN access map can consist of one or more map sequence, each sequence with a match clause and an action clause. The match clause specifices IP, IPX, or MAC ACLs for traffic filtering and the action clause specifies the action to be taked when a match occurs. When a flow matches a permit ACL entry, the assciated action is taken and the flow is not checked against the remaining sequences. When a flow matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next sequence. If aflow does not match any ACL entry and at least on ACL is configured for that packet, the packet is denied.

Three VACL actions are permitted:

  • Permit (with capture, Catalyst 6500 only)
  • Redirect (Catalyst 6500 only)
  • Deny (with logging, Catalyst 6500 only)

Two features are supported on Catalyst 6500 only:

VACL Capturewhere Forwarded packets are captured on the capture port. The capture option is only permit ACEs. The capture port can be an IDS port or an Ethernet port. The capture port must be an egress VLAN for layer-3 switched traffic.

VACL Redirect where matching packets are redirected to specific ports. You can configure up to five redirect ports. Redirect ports must be in a VLAN where a VACL is applied.

Define a VLAN Access MAP

switch#configure terminal
switch(config)#vlan access-map map-name seq# insert to/delete from

Configure the match clause in a VLAN access map sequence

switch(config-access-map)#match options

Configure actions

switch(config-access-map)#action options

Apply the VACL to VLANs

switch(config)#vlan filter map-name vlan-list list

Verify configuration

switch(config)#show vlan access-map map-name

Source for this Config document Section

Private VLANs

Internet Service Providers (ISP) often have devices from multiple clients, in addition to their own servers resident on a single demilitarized zone(DMZ) segment of VLAN. Cisco Catalyst 6500/4500 switches Private Virtual Local Area Networks (PVLAN) to keep some switch ports shared and some switch ports isolated, even if the ports exist in the same VLAN. The 2950 and 3550 support “protected ports”, which are functionally the same on a per-switch basis.

Traditionally ISPs used one VLAN per customer, with each VLAN having its own subnet. A layer 3 device the provides interconnectivity between VLANs and Internet destinations. Problems with this method:

  • Supporting a VLAN per customer may require a high number of interfaces on ISP network devices.
  • Spanning Tree becomes more complicated with many VLAN iterations.
  • Network address space must be divided into many subnets, which wastes space and increases management complexity.
  • Multiple ACL applications are required to maintain security on multiple VLANs, resulting in increased management complexity.

PVLANs provide Layer-2 isolation between ports within the same VLAN, thereby eliminating the need for VLAN and IP subnet per customer.

A Port in a PVLAN can be one of three types:

  • Isolated: port has complete Layer-2 separation from other ports within the same PVLAN, except for promiscuous ports; blocks all traffic to isolated ports except from promiscuous ports. Traffic received from an isolated port is forwarded only to promiscuous ports.
  • Promiscuous: ports can communicate with all ports within the PVLAN. The default Gateway (DG) is probably be hosted as a promiscuous port.
  • Community: ports communicate among themselves and their promiscuous ports. These interfaces are isolated at Layer-2 from all other interfaces in other communities, or in isolated ports within their PVLAN.

Trunks carry all VLAN traffic so isolated, promiscuous and community PVLAN traffic may enter and leave a switch through trunks

PVLAN ports are associated with a set of supporting VLANs that are used to create the PVLAN structure.

  • As a Primary VLAN: carrying traffic from promiscuous ports to isolated, community and other promiscuous ports in the same primary VLAN.
  • As an Isolated VLAN: carrying traffic from isolated ports to a promiscuous port.
  • As a Community VLAN: carrying traffic between secondary VLANs. You can extend PVLANs across multiple devices by trunking primary, isolated, and community VLANs to other devices that support PVLANs.

A promiscuous port can service only one primary VLAN. A promiscuous port can service one isolated VLAN or many community VLANs.

Configuring

Step 1: Set VTP Mode to Transparent

switch#configure terminal
switch(config)#vtp mode transparent

You may also want to check VTP version, password and domain while you are at VTP configuration

Step 2: Create the secondary VLANs (Isolated and community VLANs are secondary VLANs)

switch#configure terminal
switch(config)#vlan 102
switch(config-vlan)#private-vlan isolated
switch(config-vlan)#end
switch#show vlan private-vlan type

Step 3: Create the primary VLAN

switch#configure terminal
switch(config)#vlan 100
switch(config-vlan)#private-vlan primary
switch(config-vlan)#end
switch#show vlan private-vlan type

Step 4: Associate the secondary VLAN with the primary VLAN. Only one isolated VLAN can be mapped to a primary VLAN, but more than one community VLAN can be mapped to a primary VLAN

switch#configure terminal
switch(config)#vlan 100
switch(config-vlan)#private-vlan association add 102
switch(config-vlan)#end
switch#show vlan private-vlan type

When associating secondary VLANs with primary VLANs use these best practices:

  • Make sure that the VLAN IDs contain only one isolated VLAN ID (VID)
  • Use the remove keyword with the secondary VID to clear association; there can only be one association.
  • Use the no keyword to clear all association from the primary VLAN.
  • Do not allow the command to take effect until you exit VLAN configuration submode.

Step 5: Configure an interface as an isolated or community port.

switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport mode private-vlan host
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport

Step 6: Associate the isolated port or community port with the primary/secondary VLAN pair

switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport private-vlan mapping 100 102
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport

Step 7: Configure an interface as a promiscuous port

switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport mode private-vlan promiscuous
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport

Step 8: Map the promiscuous port to the primary/secondary VLAN pair

switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport private-vlan host-association mapping 100 102
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport

Step 9: Permit Routing of Secondary VLAN Ingress Traffic

switch#configure terminal
switch(config)#interface vlan 100
switch(config-if)#private-vlan mapping add 102
switch(config-if)#end
switch#show interfaces private-vlan mapping

The sources for this config section include this Cisco 4500 document and this document. Finally CCIE Blog gave me a some insight and hint as to WTF the difference between the host and promiscious ports on the interface config was.

Definition

Logical Operation Unit (LOU) are hardware registers used to store {operator, operand} tuplesfor Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port numbers specified in an IP extended ACL, VACL, or QoS ACL. These tuples are called Layer 4 Operations (L4Op).

Source

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

References I want to rememeber:

Hucaby, D. (2007). CCNP Self-Study: CCNP BCMSN Official Exam Certification Guide, Fourth Ed, VLAN Access Lists (page. 413-414). Indianapolis: Cisco Press.

VLAN Configuration Errors

Published
by
Deon Botha
on April 14, 2008
in BCMSN, Certification, Cisco Systems, Concepts and Constructs, Trunk, VLAN and VTP
. 1 Comment

Common VLAN configuration errors made when configuring VLANs are listed below.

802.1Q Native VLAN Problem

An 802.1Q trunk link doesn’t encapsulate frames but adds a tag and re-calculates the frame-check sequence (FCS) of the frame. The 802.1Q trunk also allows for untagged frames to pass through the trunk on the NATIVE VLAN. A common configuration error is when there is a trunk link and the NATIVE VLAN is not the same on both sides of the trunk causing connectivity issues.

802.1Q Native VLAN Resolution

  • NATIVE VLANs must coincide on both ends of the trunk link otherwise a trunk link may not form.
  • Cisco NATIVE VLAN is default VLAN 1, for security purposes make the NATIVE VLAN something that is not used for normal purposes.switch(config-if)#switchport trunk native vlan 1-4094
  • If there is a NATIVE VLAN mismatch CDP (if used and active) will issue a “native VLAN mismatch” error.
  • On select versions of IOS CDP may not be transmitted if VLAN 1 is not working or automatically be disabled on the trunk.
  • If there is a NATIVE VLAN mismatch on either side of an 802.1Q trunk, layer-2 loops may occur because VLAN 1 STP bridge protocol data units (BPDUs) are sent to the IEEE STP MAC untagged.
  • When troubleshooting VLANs note that a link can have one NATIVE VLAN association when in access mode and another when in trunk mode.

Trunk Link Problems

There are certain elements that determine whether a trunk link is formed or not, the elements that determine this are the trunking mode, the encapsulation type, the VTP domain, and the hardware capabilities of the connected ports.

Trunks can be configured to either statically or autonegotiate trunks with the use of Dynamic Trunking Protocol (DTP), for autonegotiation the switches must be in the same VTP Domain. There are however certain other small things to take note of about the configuration with trunk links.

Through the use of the switchport command trunks can be autonegotiated. There are certain variations of the command that will not setup a successful trunk through; the command is below and there are some of the options available: swtich(config-if)#switchport mode dynamic / auto / desirable / trunk We wish to config a trunk link the following options will not create a trunk. swtich1(config-if)#switchport mode auto
swtich2(config-if)#switchport mode auto
This shows both interfaces in switchport mode auto and will not config a trunk.swtich1(config-if)#switchport mode dynamic
swtich2(config-if)#switchport mode access
This shows one interface switchport mode dynamic desirable and the other static access and will not config a trunk.swtich1(config-if)#switchport mode trunk
swtich2(config-if)#switchport mode auto

This shows one interface switchport mode trunk and the other interface switchport interface auto. This config will not create a trunk because the interface set to trunk will not send DTP frames and then the auto interface will switch to being an access port.

This topic is something I can feel in my bones will come up in tests you either have this topic down or don’t have a clue and guestimate. I think I am going to try and know it because it’s easy enough to make a table and just learn; check out CCIE Pursuit for a table on the 3550/3560 routers and bitmindframes for more info on each DTP config state.

DTP Requirements

The reason a Network Administrator would deploy DTP is to automate to a degree the trunking process. To give you more of an explanation if a port can become a trunk (switch-switch not supported on routers), it may also be able to trunk automatically, and in some cases even negotiate the type of trunk (ISL/802.1Q). This is where DTP comes in to provide the negotiation of the trunking method with the neighbour device.

There are however requirements for DTP the main one being support for ISL or 802.1Q on both ends of the trunk (Switch A and Switch B must support and be configured with one or the other) so that DTP can do its job.

This can be expanded slightly where the switch platform does or doesn’t provide support for ISL but does support 802.1Q trunking and supports DTP like the Catalyst 4500/4000 (CatOS), which includes 2948G/2980G/4912G also the Catalyst 2950/2955/2940 series. This simply means all trunking will be done using 802.1Q.

Lastly where both ISL and 802.1Q is supported but DTP is not like the Catalyst 2900XL/3500XL/2948G-L3/4908G-L3/4840G/8500 Series.

Trunk Link Resolution

Trunk Negotiation is managed by DTP, which is Cisco proprietary, and is a point-to-point protocol (see any problems with this yet) when using DTP make sure that both ends of the link are in the same VTP Domain otherwise it wont work. Secondly because it is Cisco proprietary certain network devices wont support DTP which could cause misconfiguration cross-brands (when configuring on an interface that is connected so something non-cisco turn off DTP). Find some more information here that’s doesn’t assume you know something about DTP before jumping right in and also covers some other topics in the same post.

The correct way then to configure a port to either trunk or not would be for access ports swtich(config-if)#switchport mode access for trunking without DTP swtich(config-if)#switchport mode trunk
swtich(config-if)#switchport mode nonegotiate
then finally for encapsulation type on the trunk port swtich(config-if)#switchport trunk encapsulation dot1q
swtich(config-if)#switchport trunk encapsulation isl
. Keeping in mind that dot1q is cross-vendor and isl is also Cisco proprietary.

VTP Problems

Problem Possible Causes
Updates not received as expected
  • VTP Domain name and password must match with the server. (case
    sensitive)
  • VTP version must be compatible with the other switches on the
    domain.
  • Ensure that there is at least one server in the VTP Domain.
  • check that a trunk link exists to the VTP Server
Missing VLANs
  • Upon initial configuration, the VTP Server may have been a
    partial VLAN database, and it overwrote the existing, more complete,
    database on the existing switch.
  • VLANs were deleted individually at the VTP server, and those
    deletions will be propagated in the domain.
  • Not all Cisco switches support extended VLANs.
Too many VLANs
  • The VTP Server has a VLAN list that is more complete than the
    list needed by other switches in the domain.

The VTP Resolution and best practices are dealt with in a previous post

Trunk and VLAN Specific

Sometimes it is needed to only carry specific/certain VLANs accross trunk links. You will remember from the CCNA that by default all VLANs are allowed across a trunk link when it is created unless specifically told otherwise. This will mean that VLAN 1 through x will traverse a trunk unless you as Admin say otherwise. In some situations having all vlans moving across trunks is not the desired sitatuation.

As an example if you have VLAN 1 through 10, assume 1,3,6, and 9 is actively used on one Switch 1 and  2,4,6,8 and 10 on Switch 2.

There is no “active” users for VLANs 2,4,6,8, and 10 on Switch 1 and no active users for VLaN 1,3,6, and 9 on Switch 2 why then send these VLANs all over the place when this will be wasteful?  To change this situation one can use any one of these commands:

Switch(config-if)switchport trunk allowed vlan remove/except/add x,x,x

Using either the remove 2,4,6,8 and 10, except 2,4,6,8,10 or add 1,3,6,9 command will have the same end result of allowing only 1,3,6, and 9 across the trunk link.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

VTP Configuration

Published
by
Deon Botha
on April 10, 2008
in BCMSN, Certification, Cisco Systems, Concepts and Constructs, VLAN and VTP
. 2 Comments

Configuring VTP is as easy as one two three, literary :-)

  1. VTP Domain
  2. VTP mode
  3. VTP password

All switches in the same VTP domain will share the VTP domain and VTP password (if a password is configured for use). It is good practice to set the VTP mode to client if switches are being added to an existing switched network that uses VTP (use it don’t use it, for more look at the next section below the configuration for the steps involved) this is unless you want all your VLAN information going missing which means you have to re-load all your VLANs for large enterprise networks this could take many hours.

Configuration
switch>enable
switch#show vlan brief
Displays a list of VLANS Configured on Switch this list will replace all other VLAN information on the network if this is to be VTP Server
switch#configure terminal
switch(config)#vtp password my_password
switch(config)#vtp domain my_domain
switch(config)#vtp version 1/2
switch(config)#vtp mode client/server/transparent
switch(config)#exit
switch#show vlan brief
Now either you will see the same VLANs or other VLANs that were advertised from the VTP Server if this is a VTP Client

Verification:
In this output, Configuration last modified by specifies the IP address of the switch that last updated the VLAN database of this switch.
switch#show vtp status
In the next output this verifies if VTP updates are being sent and received.
switch#show vtp counters

Things to keep in mind

VTP has small nuances that make it a pain to work with, the most obvious and the one I stress overly much is that VTP can create lots of work for you by deleting the entire enterprise VLAN database in a matter of seconds if you aren’t careful. This is something that you have to respect about VTP as it is a great time safer with respect to admin intense vlan creation but can also cause you headache.

Other small things being that there are 2 mainstream versions of VTP available and they are not interoperable (There is a version 3 available on big switch platforms). The default setting for VTP is Version 1 even if the switch platform supports Version 2, this is because of the interoperability issue. To use Version 2  explicitly set the server mode to Version 2 and the change will be propagated. Changes between Version 1 and Version 2 include

  • Version-dependant transparent mode where Version 1 matches VTP version and domain name before forwarding information to other switches. Version 2 forwards without checing the version number.
  • Consistency Checks are performed on VTP and VLAN parameters entered in the command line interface (CLI) or by simple network management protocol (SNMP). This prevents errors in vlan numbers and names from being propagated to other switches.
  • Token Ring support
  • Unrecognized Type-Lenght-Value (TLV) support will propagate received configuation changes even if the switch supervisor engine cannot parese of understand the message.

The VTP Domain name is case sensitive this is important and can only contain a maximum of 32 characters. If there is connectivity between two switches, there is no VTP password set and VTP is not propagating check that the CaSe is identical in the domain. For more in setting up VTP

The other final small thing is that VTP uses the configuration revision number to determine in the VTP domain whether it will accept or reject VTP advertisements. If the domain name is the same of the client or server then it checks the configuration revision number to see if it is going to update the vlan database. If the revision number of an update received on a client or server VTP switch is higher than the previous revision, then the new configuration is applied. Otherwise, the configuration is ignored. This comes back to being very careful as to the switches you just simply add to the network.

Adding a switch to VTP Network

Adding a new switch to an existing network can create a lot of work for you if you are not careful, follow these steps to make sure you aren’t shooting yourself in the foot.

This assumes that there is a “NEW” switch and an existing network to which the NEW switch is to be connected. The term “NEW” can either be right out the box brand spanking “NEW” from Cisco or “NEW” from ebay.

  1. Make 110% sure that there is no network connectivity with the NEW switch and the existing network; then power on the switch.
  2. Change the switch VTP mode to transparent on the NEW switch.
  3. Delete vlan.dat on the NEW Switch.
  4. Change the VTP domain name to something unconventional that is not in use on the network, and change the mode to client on the NEW Switch.
  5. Reload or power cycle the switch NEW Switch.
  6. Verify the switch VTP mode, VTP domain name, and vlan.dat configuration.
  7. Configure the switch with the existing network settings and a valid VTP domain name and password.
  8. Connect the NEW switch to the network.
  9. Verify the VLAN database has propagated.

There are furthermore some other best practices concerning VTP Configuration when it comes to the ECNM:

  1. The ECNM gives boundaries for VTP Domains. Not all switches need information on all VLANs (end-to-end). In the ECNM VTP Domains should be restricted to redundant distribution layer switches and access layer switches.
  2. Have only one or two switches configured as VTP Servers and the remainder as clients.
  3. Configure a password for the VTP Domain to increase security and not make more work for yourself should someone try and add a VTP switch (in sever mode) to the domain without your knowledge.

    I know of a network where a a lab switch (old network switch) used during training added to the lab network deleted the VLAN database of the enterprise network. *shrug*

  4. Manually configure the VTP domain name on all switches that are installed in the network so that the mode can be specified and the default mode of the server on all switches can be overwritten (see above for why)
  5. When you are setting up a new domain configure VTP clients switches first so that they participate passively; then configure servers to update client devices after the fact.
  6. In an existing domain, when performing clean-up, configure passwords on the servers first. clients may need to maintain current LAN information until the server contains a complete VLAN database. After the VLAN database on the server is verified as complete, client passwords can be configured to the server passwords to propagate the VLAN Database.

Some Asides that I wondered about

Doing some final revision and asking the Google about some weird questions CCIE Pursuit came up with the asnwers, this one has happened to me IRL where the switch came back up as Server. Also a question about the MD5 and VTP was neatly answered all in one visit.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

VLAN Trunk Protocol

Published
by
Deon Botha
on April 10, 2008
in BCMSN, Certification, Cisco Systems, VLAN and VTP
. 1 Comment

VLAN Trunk Protocol (VTP) is what manages a consistent list of VLANs between switches on the enterprise network. All switches that share common information are grouped in VTP management domains. The “global” VLAN information shared between switches are VLAN number, name and description thereby keeping the same VLAN information shared between enterprise switches; more particular information like port assignments is kept local to each switch.

What this means is that you will have VLAN informaiton consistent on all switches of the enterprise but port assignment will have to be done manually on each switch.

Switches within a VTP Domain synchronize their VLAN databases by sending and receiving VTP advertisements over trunk links. VTP advertisements are flooded throughout a VTP domain by switches (every 5 minutes or when a change happens) over VLAN 1 (Cisco default NATIVE VLAN) using layer-2 multicast frame.

Describing the VTP:

VTP is a layer-2 messaging protocol that maintains VLAN configuration consistency between switches by managing the additions, deletions, and name changes of VLANs on all switches in a VTP domain. VTP runs over trunk links allowing interconnected switches to exchange layer-2 frames, synchronizing a single list of configured VLANS.

These are the attributes of VTP:

  1. VTP is a Cisco Proprietary protocol.
  2. VTP will advertise VLANs 1-1005 only.
  3. VTP updates are exchanges only across trunk links.
  4. Each switch operates in a given VTP mode (server, client, transparent) which determines how VTP updates re sent from and received by that switch.

These are the attributes of a VTP Domain:

  1. A switch can only belong to one one VTP Domain.
  2. A VTP Domain may be as small as only one switch.
  3. VTP Updates will be exchanged only with other switches in the same domain.
  4. The way VLAN information is exchanged between switches in the same domain depends upon the VTP mode on the switch (server, client, transparent).
  5. By default, a Cisco Catalyst switch is in the no-management-domain state until it receives an advertisement for a domain over a trunk link, or until a management domain is configured.

These are the attributes of a VTP Modes:

VTP Mode Feature
Server
  • Creates, Modifies, and deletes VLANs at the CLI
  • Generate and forwards VTP advertisements from other switches in
    the same management domain.
  • May update its own VLAN database with information received from
    other serves in the management domain
  • Saves VLAN configuration information in “vlan.dat” file in Flash
    memory
Client
  • Cannot create, modify, or delete VLANs at the CLI
  • Forwards VTP advertisements received
  • Synchronizes its own VLAN database with latest information
    received from VTP server in the management domain
  • VLAN information in RAM only, not stored in NVRAM or FLASH; must
    be repopulated from VTP Server if switch powered down
Transparent
  • Creates, modifies, and deletes VLANs for the VLAN database on
    the local switch only
  • Does not generate VTP advertisements
  • Does not update its VLAN database information received from VTP
    servers in the same management domain
  • Forwards VTP advertisements received from VTP servers in the
    same VTP domain
  • Always has configuration revision number of 0
  • Saves VLAN configuration to NVRAM

VTP Versions:

Version 2:

  1. Supports Token Ring Switches.
  2. Consistency checks on new VTP and VLAN configuration parameters.
  3. Propagation of VTP updates that have an unrecognized type, length, or value.
  4. Forwarding of VTP updates from transparent mode switches without checking the version number.

Version 3:

  1. Support for extended VLANs.
  2. Support for the creation and advertisement of private VLANs.
  3. Support for VLAN instances and Multiple Spanning Tree (MSTP) mapping propagation instances.
  4. Improved server authentication.
  5. Protection from the wrong database accidentally being inserted into a VTP domain
  6. Interaction with VTP Version 1 and VTP Version 2.
  7. Ability to be configured on a per-port basis.

VTP Pruning

By default a trunk link carries all traffic for all VLANs in a VTP management domain. It is common however that all switches in the enterprise does not have all VLANs configured on all ports. VTP Pruning increases availability of bandwidth by decreasing traffic on trunk links through restriction of flooded traffic by network devices.

VTP Confiruation Revision Number

When VTP is initially configured the VTP configuration revision number is 0 (zero). Each time a VTP server modifies its VLAN information the configuration revision number is incremented by one. This new revision number is then sent out with the new VTP information and all switches with a lower configuration revision number are updated.

ECNM

There are some guidlines to using VTP in the Campus Infrastructure Model:

  1. VTP Domain is restricted to the building Switch blocks.
  2. VTP keeps VLAN information consistent between building distribution layer and building access layer switches.
  3. VTP configuration errors or failures will be confined to the distribution and access layer switches.
  4. Knowledge of all VLANs does not need to exist on all switches within the Campus infrastructure model.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

VLAN Ranges

Published
by
Deon Botha
on April 10, 2008
in BCMSN, Certification, Cisco Systems, Concepts and Constructs and VLAN
. 1 Comment

This topic is interlinked to VLANs and as such an understanding of that topic is important. On a network each VLAN must have a unique VLAN ID (VID). The valid range depends on the trunking protocol used. This depends on how VTP Advertisements will be handled in the end accross switches in the enterprise.

ISL supports VIDs from 1 to 1023
802.1Q supports VIDs from 1 to 2094

VLAN RANGE RANGE USE VTP PROPOGATED
0, 4095 Reserved
  • System use only
-
1 Normal
  • Cisco Default (Admin).
  • Can be used; Cannot be modified or deleted.
Yes
2-1001 Normal
  • VLANs can be used, created and deleted.
Yes
1002-1005 Normal
  • Cisco Default for FDDI and Token Ring.
  • Cannot be deleted.
Yes
1006-4096 Extended
  • Ethernet Only.Layer 3 ports and some software require internal VLANs.
  • Internal VLANs in this range cannot be used if it has been allocated for this function.
  • To display show vlan internal usage
  • Switches running CatOS do not support this feature
  • Best practice begin at 4094 and work downwards when using this range.
No

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.


Search

About

You are currently browsing the Network Ninja weblog archives for the VLAN category.

Latest

RSS
  • Digital Growth with your Job
  • Open Shortest Path First – OSPF Fundamentals – Scenario
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 13
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 12
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 11
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 10
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 9
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 8
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 7
  • Open Shortest Path First – OSPF Fundamentals – Questions and Answers – Question 6

Archives

  • June 2009
  • April 2009
  • March 2009
  • February 2009
  • November 2008
  • October 2008
  • September 2008
  • August 2008
  • July 2008
  • June 2008
  • May 2008
  • April 2008

Categories

  • 802.11 (7)
  • 802.1Q (1)
  • 802.1X (1)
  • AAA (1)
  • Access Point (7)
  • ACL (4)
  • Addressing (3)
  • Asides (31)
  • auto-summary (3)
  • AutoQoS (1)
  • Bandwidth (2)
  • BCMSN (55)
  • BDR (2)
  • BGP (1)
  • BPDU Filtering (1)
  • BPDU Guard (2)
  • BPDU Root Guard (1)
  • BSCI (67)
  • BSCI Notes (18)
  • BSCI Questions (48)
  • Business (1)
  • Cabling and Equiptment (3)
  • CAM (1)
  • CCDA (1)
  • CDP (1)
  • CEF (1)
  • Certification (123)
  • CIDR (2)
  • CIR (2)
  • Cisco Systems (144)
  • Concepts and Constructs (76)
  • CoS (1)
  • Cost (3)
  • DAI (1)
  • DDNS (1)
  • Debug (2)
  • DHCP Snooping (1)
  • DHCP Spoofing (1)
  • DR (3)
  • DUAL (1)
  • Dynamic ARP Inspection (1)
  • ECNM (5)
  • EIGRP (5)
  • Enterprise Architecture (7)
  • EtherChannel (1)
  • GLBP (1)
  • Hello Timer (2)
  • Hold Timer (2)
  • Hot Standby Router Protocol (1)
  • HSRP (1)
  • IGRP (1)
  • IIN (2)
  • Inter-Vlan Routing (1)
  • Interconnection Technologies (2)
  • IP Source Guard (1)
  • IS-IS (1)
  • ISL (1)
  • LACP (1)
  • Link State Advertisements (2)
  • Load Balancing (2)
  • Loop Guard (1)
  • MAC Address Flooding (1)
  • MLS (1)
  • MSTP (1)
  • NBAR (1)
  • NBMA (1)
  • Off-Topic (12)
  • OSPF (18)
  • PAgP (1)
  • passive-interface (1)
  • PoE (1)
  • Port Security (1)
  • Priority (2)
  • Proxy ARP (1)
  • PVC (1)
  • QoS (2)
  • RIP (1)
  • RIPv2 (1)
  • Root Guard (1)
  • RSTP (1)
  • Show (6)
  • Software (1)
  • SONA (2)
  • SSH (2)
  • STP (5)
  • Stub Router (3)
  • summary-address (1)
  • Support (4)
  • Switch Spoofing (1)
  • TCAM (1)
  • Telnet (2)
  • Troubleshooting (1)
  • Trunk (6)
  • Unidirectional Link Detection (1)
  • VACL (3)
  • VC (1)
  • Vine (20)
  • VLAN (11)
  • VLAN Hopping (1)
  • VLSM (1)
  • VoIP (1)
  • VRRP (1)
  • VTP (4)
  • VTY (1)
  • Wireless (7)


Styled with Sawchuk

Powered by WordPressabc and K21.0-RC7

Entries Feed and Comments Feed

70 queries. 3.6830 seconds.