Learning by practicing

Sunday, December 31, 2017

Cisco CCNP:300-115 - 1.4 Configure and verify trunking: 1.4.a VTPv1, VTPv2, VTPv3, VTP pruning

Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.

         - VTP is a Layer 2 messaging protocol
         - VTPv1 and v2 support standard VLAN range (1-100)
         - VTPv3 supports the entire VLAN range (1-4094) which includes the extended VLAN range (1006-4094)
         - VTPv3 cannot be converted to VTPv2 if extended VLANs are configured in the domain
         - A switch can only be in one VTP domain
         - Until a anagement domain name is learned or specified, you cannot create or modify VLANs on VTP server
         - VLAN information not propogated on the network until a VTP domain name is specified or learned
         - Switches uses the highest revision number to determine how to update its database
         - "Transparent" mode allows for creation and modification of VLANs. However, those VLANs are not propogated to any other devices
         - VTP modes include:
            - Server:
                - Allows for creation, modification and deletion of VLANs and other configuration parameters.
                - VLAN configuration is saved in NVRAM
                - Advertisements send to devices in the same VTP domain
                - When a switch detects a failure when writint to NVRAM, the VTP mode automatically changes from "Server" to "client"
            - Client:
                - Receives and transmits learned updates
                - Cannot create, delete or modify VLANs
                - In VTPv1 and v2 VLAN config not saved in NVRAM.
                - In VTPv3 configuration saved in NVRAM
            - Transparent:
                - Switches do not participate in VTP
                - Does not advertise or synchronize its learned VLANs or configuration in VTPv1
                - VTPv2 and v3 transparent mode allows for forwarding of VTP advertisements
                - You can create, delete and modify VLANs
                - If using VTPv1 or v2, the switch must be in VTP transparent mode when you create extended-range (1006-4094)
                - VTPv3 support creatign extended-range VLANs while in client or server mode
                - VTPv1 and v2 supports private VLAN but the switch must be in "transparent"
                - VTPv3 supports private VLANs in client and server modes
                - Configuration saved in NVRAM but not advertised to other switches
            - Off:
                - Functions much the same as a VTP transparent switch
                - However, does not forward VTP advertisements on trunks

          - VTP advertisements contain:
                - VTP domain name
                - VTP configuration revision numer
                - Update identify and update timestamp
                - MD5 digest VLAN configuration, which includes the MTU
                - Frame format

            - VTP Advertisements distribute the following for each configured VLAN:
                - VLAN ID
                - VLAN name
                - VLAN type
                - VLAN state
                - Additonal VLAN configuration information specific to the VLAN type

            - VTPv3 advertisements also include the primary server ID, an instance number and a start index
            - By default VTP operates in v1
            - VTPv2 supports Token Ring
            - Unrecognized TLVs. These are stored in NVRAM when the switch is in VTP server mode
            - VTPv2 version supports only one domain
            - If the MD5 digest matches, the information is correct


      - VTP Version 3
          - Uses enhanced authentication via "hidden" or "secret"
          - "hidden" saves the secret key from the password string in the VLAN database file but not in plaintext in the configuration
          - "hidden" saves the hexadecimal key associated with the password in the running config
          - "secret" allows for confiuration of the password secret key
          - Supports extended VLAN range (1006-4094)
          - If extended VLANs are configured you cannot convert from VTP v3 to v1 or v2
          - VTP pruning still applies to VLANs 1-1005
          - VLANs 1002-1005 are still reserved and cannot be modified
          - supports private VLAN
          - Supports any data in adomain
          - Can also propogate Multiple Spanning Tree (MST) protocol database information
          - A separate instance of VTP protocol runs for each application that uses VTP
          - Uses the concept of Primary and secondary sever
          - Primary server updates the database information
          - Secondary servers can only backup updated VTP configuration received from the primary server to its NVRAM
          - By devfault all devices come up as secondary servers
          - To specify a primary server use:
                SecurityNik#vtp primary

          - You can have a working VTP domain without any primary servers
          - The primary server status is lost if the device reload or domain paramaeters change
          - Allows for turning VTP on or off on a trunk (per-port) basis
          - VTP cannot be set to "off" for MST database
          - VTP cannot be set to "on" for the VLAN database on the same port
          - Setting VTP to "off" globally, applies it to all trunking ports in the system
          - However can still set to "on" or "off" on a per-VTP instance basis

          - VTP version 1 and 2 supports VTP modes "server", "client" and "transparent".
          - VTP v3 supports one addition mode called "off". This means it support 4 modes, "off", "server", "client" and "transparent"
          - VTP v1 and v2 supports only normal range VLANs (1-1005)
          - the switch must be in VTP "transparent" mode if you create VLANs from 1006-4094
          Only VTPv3 supports extended range (1006-4094) VLANs
          - Cannot convert from VTPv3 to VTPv2 if exteded VLANs are configured in the domain
          - For VTP to work, there must be a truk port on one switch connected to a trunk port on a second switch
          - In VTPv1 and v2 the swtich must be in VTP "transparent" or "server" modes you can add, modify or remove configurations from VLANs 2-1001.
          - VLANs 1, 1002-1005 are automatically created and cannot be removed
          - In VTPv1 and v2, the switch must be in "transparent" mode when creating extended (1006-4094) VLANs
          - Configuration for VLANs 101005 are stored in the "vlan.dat" file
          - Attempting to manually delete the "vlan.dat" file may lead to inconsistency
          - VLANs 1-1005 are always stored in "vlan.dat" file
          - When the VTP mode is "transparent", the VLANs are stored in the switch running configuration
          - To use VTP at least one trunk has to be established between two hosts

References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvlan.html
https://learningnetwork.cisco.com/community/certifications/ccnp/switch_v2/exam-topics
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wpxref
https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010.html

Cisco CCNP:300-115 - 1.3.c Normal, extended VLAN, voice VLAN

Cisco CCNP:300-115 - 1.3 Configure and verify VLANs

Cisco CCNP:300-115 - 1.2.b UniDirectional Link Detection (UDLD)

Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.

          - Cisco proprietary
          - Layer 2 Technology
          - Not supported on ATM ports
          - UDLD port cannot detect unidirectional link if it is connected to a UDLD-incapable port of another switch
          - By default disabled globally and on all Ethernet and fiber-optic ports
          - Can be enabled via:
              SW2(config)#udld enable
                    OR
              SW2(config)#udld aggressive
          - Enable on the interface via:
              SW1(config-if)#udld port
                  OR
               SW1(config-if)#udld port aggressive
          - Default message interval "15"
          - Default timeout interval "5"
          - Shows "CDP Device name"
          - Can reset ports disabled by UDLD via:
               SecurityNik#udld reset

          - Enables devices connected through fiber-optic or twisted pair cable to monitor the cable's physical configuration
          - Can recognize when a unidirectional link exists
          - All connected devices must support UDLD for the protocol to successfully identify and disable unidirectional links
          - When UDLD detects a unidirection link it disables the link and alerts you
          - UDLD links can cause a variety of problems, including:
              - spanning-tree topology loops caused by undirectional links
              - Incorrect cabling of unbundled fiber strands
              - Tranceiver or link hardware malfunctioning
              - Incorrect or excessive flooding of packets
              - Loss of traffic without notice (also known as black holing)
          - UDLD supports two modes:
            - Normal (Default)
                - Can detect unidirectional links due to misconnected ports on fiber-optic connections
                - Detects unidirectional link when fiber-optic links are misconnected
                - Links are considered to be "undetermined" when the ports are connected correctly but the traffic is one way.
                - UDLD does not disable ports in "undetermined"
                - If one fiber strand in a pair is disconnected, once autonegotiation is active, the link will not stay up.

            - Aggressive
                - Aggressive mode disabled by default
                - Can detect unidirectional links on both fiber-optic and ethernet as well as misconnected ports on fiber-optic links
                - Can detect unidirectional link on point-to-point link
                - can detect when one of the ports cannot send or receive traffic and disable the affected port
                - One port is down while the other is up and disable the affected port
                - One of the fiber strands in acable is disconnected and disable the affected port

         - Works with Layer 1 mechanisms to learn the physical status of links
         - UDLD performs tasks that auonegotiation cannot perform
         - Can detect the identities of neighbors
         - Can shutdown misconnected ports
         - When UDLD is enabled both Layer 1 and Layer 2 detections work together to prevent physical and logical unidirectional connection and the malfunctioning of other pprotocols
         - Unidirectional link is when traffic sent by one device is received by its neighbor but the traffic from the neighbor is not received by the original sender
         - On point-to-point links UDLD hello packets as hearbeats which determines the health of the link
         - The absence of heartbeat means the link must be down

        Unidirectional links are detected via the following:
          - Neighbor database maintenance
              - Neighbors are learned via hello packets known as advertisements or probes
              - Hello sent on every active port
              - Whenever a switch receives a new hello before the old one expires, it replaces the old one with the new one
              - UDLD clears all existing cache entries whenever the following occurs:
                - port is disabled and UDLD is running
                - UDLD is disabled on a port
                - Switch reset
              - Caches are kept synchronized via a message sent to the neighbor notifying them to flush the part of their cache affected by the status change

          - Event-driven detection and echoing
              - UDLD uses echoing for its detection mechanism
              - Detection window is restarted whenever a new neigbor is learned or a resynchronization request is received from an out-of-sync neighbor
              - When the detection windows ends and there is no valid reply messages, the link is shutdown depending on the mode:
                - In normal mode, if the link is considered to be in "undetermined" mode, the link may not be shutdown
                - When in agressive mode, the link is considered unidirectional and the port is disabled

          - Verifying UDLD configuration can be done with:


          SecurityNik#show udld neighbors
Port     Device Name   Device ID     Port ID    Neighbor State
----     -----------   ---------     -------    --------------
Fa1/0/10 FDO1446K0S2     1            Gi1/0/10   Bidirectional

          OR
         SecurityNik#show udld fa1/0/10

Interface Fa1/0/10
---
Port enable administrative configuration setting: Enabled
Port enable operational state: Enabled
Current bidirectional state: Bidirectional
Current operational state: Advertisement - Single neighbor detected
Message interval: 15
Time out interval: 5

    Entry 1
    ---
    Expiration time: 38
    Device ID: 1
    Current neighbor state: Bidirectional
    Device name: FDO1446K0S2
    Port ID: Gi1/0/10
    Neighbor echo 1 device: CAT0945R1HE
    Neighbor echo 1 port: Fa1/0/10

    Message interval: 15
    Time out interval: 5


    CDP Device name: SW2
        -----------------------------------------------------------

References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swudld.html
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/udld.html

Cisco CCNP:300-115 - 1.2 Configure and verify Layer 2 protocols: 1.2.a CDP, LLDP

Cisco CCNP:300-115 - 1.1 Configure and verify switch administration: 1.1.c Troubleshoot Err-disable recovery

Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.

        - To see the current status of all interfaces, use:
          SecurityNik#show interfaces status


        - To see the current status of an interface, use:
          SecurityNik#show interfaces fast1/0/22 status

        - If your configuration shows a port as enabled but the software detects an error on the port, the software shuts down the port
        - Switch ports are automatically disabled by the switch OS when error conditions are detected on a port
        - Ports in "err-disabled" state are effectively shutdown. No traffic is sent or received on the port in question
        - Port LED is set to orange colour
        - The "show interface status" will show the port as "err-disabled"
        - Syslog and Console messages may also be seen on he screen when an error condition is detected

        - The error disable function serves the following two purposes:
            - Notifies the administrator of a port problem
            - Eliminates the possibility of this port causing other ports to fail because of monopolization of resources thus causing serious network issues

        Error-disable detection is enabled by default for all of the causes below:
          - Cable which is out of specification
          - Bad interface card. Can include driver or physical card issues
          - duplex misconfiguration
          - Port Channel misconfiguration
          - BPDU guard violation
          - UniDirectional Link Detection(UDLD) conditions
          - Late-Collision detection
          - Link-flat detection
          - Security Violation
          - Port Aggregation Protocol (PAgP) flap
          - Layer 2 Tunneling Protocol (L2TP) guard
          - DHCP snooping rate-limited
          - Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable
          - Address Resolution Protocol (ARP) Inspection
          - Inline Power

        To see the current state of all err-disable reason/condititon/detection
          SecurityNik#show errdisable detect

        To see the current recovery condition use:
          SecurityNik#show errdisable recovery

        By default, the system recovers after 300 seconds (5 minutes). However, this timeout is also disabled by default

        To Determine the reason for the Errdisabled state, you can review the messages generated on the console or via syslog or use:
          SecurityNik#show errdisable recovery

       - To recover a port from Errdisabled state, you should fix the problem before re-eneabling the port. If not the port will once again go back to "err-disabled" state

       - As can be seen above, there are a number of reasons why a port may be shutdown. However, here is some further elaboration:
        - Etherchannels Misconfiguration
            - For EtherChannels to work, their configuration must be consistent
              - Ports must have the same VLAN
              - Ports must have the same trunk mode
              - Ports must have the same speed
              - Ports must have the same duplex, etc
            - If one switch is configured for EtherChannel and the other is not, the spanning tree process can shutdown the channel ports on the side which is configured for EtherChannel because the currently configured switch thinks there is a loop
            - Set the channel mode to "desirable" on both sides of the connection
            - Each side will only form a channel if they both agree to channel
            - If they do not agree, then the ports on both sides continue to function as normal ports

       - Duplex Mismatch
            - Typically caused by failure to auto negotiate speed and duplex properly
            - Full duplex devices transmit whenever they have something to send regardless of other devices
            - Ensure the that both sides of the swich has the same speed and duplex configuration
            - CDP version 2 can also warn about duplex mismatch before the port is placed in error-disabled state

       - BPDU Port Guard
            - Ports with Portfast must only be connected to an endpoint device such as a workstation or server and not to other devices like switches, routers, bridges, etc, that generates spanning tree BPDU
            - If spanning tree BPDU is received on a port configured for "SW1(config-if)#spanning-tree portfast" and "SW1(config-if)#spanning-tree bpduguard enable" the switch is placed in "err-disable" mode in order to guard against potential loops
            - BPDU Guard helps to ensure the LAN stays loop free on ports which are configured for PortFast

       - UniDirectional Link Detection (UDLD)
           - Used with fiber-optic or copper Ethernet cables (i.e. Cat 5)
           - Used to monitor physical configuration of the cable and detects when a link is unidirectional
           - When unidirectional link is detected, the port is shutdown and the user is notified
           - UniDirectional links can cause spanning tree loops among other problems
           - Note: Both devices on the link must support UDLD and have it enabled. Having UDLD configured only on one side of a link may result in the configured link moving to an errdisable state

       Link Flap
          - Interface constantly going up and down
          - If the interface flaps more than 5 times in 10 seconds, it goes into the errdisabled state
          - Common cause for link flapping is Layer 1 issues such as bad cable, duplex mismatch bad GBIC card, etc.
          - Messages may be logged to the console or to a Syslog server
          - To see current flap value configuration:
          SecurityNik#show errdisable flap-values
            ErrDisable Reason    Flaps    Time (sec)
            -----------------    ------   ----------
            pagp-flap              3       30
            dtp-flap               3       30
            link-flap              5       10

        - From above we see "link-flap" is configure for 5 flaps in 10 seconds, while "pagp-flap" and "dtp-flap" are configured for 3 times in 30 seconds

       - Loopback Error
          - Keepalive packet is looped back to the port that sent the keepalive
          - Results in the port being moved to errdisabled

      - Port Security Violation
        - Can be used with both dynamically learned and statistically configured mac addresses, in order to restrict traffic on a port
        - Use the following command to configure port security violation and its options:
          SW1(config-if)#switchport port-security violation ?
            protect   Security violation protect mode
            restrict Security violation restrict mode
            shutdown Security violation shutdown mode
        - To shutdown or put the port in errdisable state, use the following:
          SW1(config-if)#switchport port-security violation shutdown

        - Security violation can occur for any of the following:
            1. Max number of secure MAC addresses reached
                - This leverages the configured port security violation
            2. When a secure mac address which is configured or learned on one port attempts to access another secure port on the same VLAN
              - This results in the shutdown violation mode
        - L2pt Guard
            - The interface goes to errdisabled when an encapsulated PDU (packet with a proprietary destination MAC address) is received from a tunnel port or access port with Layer 2 tunneling enabled

        - Incorrect SFP cable

        - 802.1x Security Violation
           - Port configured for a single host seeing a different MAC address on that interface
           - Can use "Multidomain Authentication Mode" on a switchport if you need to use an IP Phone with a host behind it
           - "Multidomain" refers to voice and data
            - "Multidomain" allows only 2 MAC addresses per port

       - For ports which have transitioned to "err-disabled" you must issue the "shutdown" followed by the "no shutdown" commands in the interface mode, eg:
            SW1(config)#int fa1/0/22
            SW1(config-if)#shutdown
            SW1(config-if)#no shutdown

       - To configure "errdisable recovery cause" for any of the options specify the options at the end. Below example enables recovery for "psecure-violation"

       SW1(config)#errdisable recovery cause psecure-violation

      - Note that one or more of the options have to be enabled and that error condition has to be met before the timeout can be taken advantage of

References:
https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html

Cisco CCNP:300-115 - 1.1 Configure and verify switch administration: 1.1.b Managing MAC address table

Cisco CCNP:300-115 - 1.1 Configure and verify switch administration: 1.1.a SDM templates - Saqib

Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.

- Used for optimizing system resources on the switch for specific features
              - SDM Stands for Switching Database Manger
              - Manages Layer2 and Layer3 switching information
              - SDMs are maintained in the switch TCAM, which is used for forwarding lookups. Lookups are done in hardware
              - Most switches have one TCAM which is stored between L2 and L3
              - 3 predefined types of SDM templates:
                -> Access Template
                      - Maximizes the system for Access Control Lists (ACLs)
                      - Used to optimize the system for a large number of ACLs

                -> Routing Template
                      - Do not use if you do not have routing enabled on the switch
                      - Maximizes resources for IPv4 Unicat routing
                      - Switch has to be acting as a router or route aggregator
                      - When enabled prevents other features from using memory allocated to Unicast Routing


                -> VLAN Template
                      - Unicast Routing is Disabled
                      - Allows for the maximum number of supported MAC addresses
                      - Implemented when the switch is purely a layer 2 device
                      - Typicall selected for L2 switch
                      - Should be used only on switches intended for L2 functionality and no routing
                      - No system resources are allocated for routing entries and routing is done via software/release/12-2_52_se/configuration/guide/3750scg/swsdm
                      - When enabled, CPU becomes overloaded thus downgrading routing performance

                -> Default Template
                      - Best of Access, Routing and VLAN templates
                      - Balances resources

                -> dual-ipv4-and-ipv6 Template
                      - When trying to enable this IPv6 without enabling this template, then a warning message is generated
                      - Do not use if you plan to use only IPv4
                      - Enables dual stack environment
                      - Has the following sub templates:
                          - VLAN
                          - Routing
                          - Default

              - Each template has two versions a "Desktop Template" and an "Aggregator Template"
              - "Aggregator Template" is limited to specific switches
              - "Default" Template is the default template for Desktop switches
              - "Aggregator" Template is the default template for 3750-12s
              - When modifying a template a "Reload" for the template to become effective
              - If being used on a stack, the SDM template on the master, overrides any SDM templates on a newly added switch
              - Larger TCAM size available in the "Aggregator Template"
              - Only 3750-12S supports the larger TCAM
              - All other switches ONLY support the "Desktop Template"
              - If "Desktop" keyword is not entered on an aggregator switch, the "Aggregator Template" is used
              - An IPv4 route requires only 1 TCAM entry
              - An IPv6 route can require MORE THAN 1 TCAM entry
              - For IPv6 the "Desktop Template" can allow fewer than 2000 entries for directly connected IP addresses
              - All switches in a stack use the SDM template used by the master. This can be either the "Desktop Template" or the "Aggregator Template"
              - If a switch which supports aggregator such as 3750-12s is added to the a stack in which the master is using the "Desktop Template", this switch template will be downgraded
              - If a switch (non 3750-12s) using the "Desktop template" is added to a stack in which the Master (3750-12s) is using the "Aggregator" template, the new switch goes into "SDM Mismatch" mode. The stack master does not attempt to change the SDM template and the switch cannot be a functioning member of the stack.

              - If the stack master is a 3750-12s, changing the SDM template can have the following effects:
                - Changing the template from "Aggregator" to "Desktop" and reloading can result in:
                    - The entire stack now operates with the "Desktop" template
                    - configuration losses if the number of TCAM entries exceed the "Desktop template" sizes

                - Changing the template from "Desktop" to "Aggregator" and reloading can result in the following:
                    - Desktop switches which were part of the stack goes into "SDM Mismatch" mode
                    - When a switch goes into "SDM Mismatch" mode, a syslog message is sent to the Stack Master notifying it of the switch being in "SDM Mismatch" mode and the actions to bring the switch out of "SDM Mismatch" mode

                - Use the "show switch" privilege exec mode command to look for switches in "SDM Mismatch" mode

        - To Set the template use in:
              SecurityNik(config)#sdm prefer ?
                          access              Access bias
                          default             Default bias
                          dual-ipv4-and-ipv6 Support both IPv4 and IPv6                          routing             Unicast bias
                          vlan                VLAN bias
        - Remember to reload after choosing the template by using
              SecurityNik#reload ?
                          *Apr 15 02:22:56.882: %SYS-5-CONFIG_I: Configured from console by console?
                          /noverify    Don't verify file signature before reload.
                          /verify      Verify file signature before reload.
                          LINE         Reason for reload
                          at           Reload at a specific time/date
                          cancel       Cancel pending reload
                          in           Reload after a time interval
                          slot         Slot number card
                          standby-cpu Standby RP
                          <cr>

        - To See the current SDM configuration in use or to see a specific template use:
              SecurityNik#show sdm prefer ?
                          access              Access bias
                          default             Default bias
                          dual-ipv4-and-ipv6 Support both IPv4 and IPv6
                          routing             Unicast bias
                          vlan                VLAN bias
                          |                   Output modifiers
                          <cr>

        - When a template is changed and the system has not been reload, using the "SecurityNik#show sdm prefer" will include a message about the next template which will be used at reload.
              - SecurityNik#show sdm prefer
                  The current template is "desktop default" template.
                    ..... (Omitted for brevity)
                  On next reload, template will be "desktop access IPv4" template.

        - To revert to the default policy enter:
              SecurityNik(config)#no sdm prefer


Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swsdm.html