Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- Used to detect EtherChannel misconfiguration if the switch is running PVST+, rapid PVST+ or MSTP
- Works by looking at the Port-ID of the incoming BPDU from the adjacent switch
- The bundle interfaces uses one mac-address
- The entire port-channel goes into "err-disabled" state when there is an error relating to these received mac-address
- A message is also sent
- To configure EtherChannel misconfiguration guard, use:
- SW1(config)#spanning-tree etherchannel guard misconfig
References:
http://tsbates.com/blog/layer-2-etherchannels/
Sunday, December 31, 2017
Cisco CCNP:300-115 - 1.5.c Load balancing
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- EtherChannel balances traffic across the different links
- Load balancing can use MAC addresses or IP addresses, source or destination addresses or both source and destination addresses
- Selected load balancing mode is applied to all EtherChannel links configured on the switch
- Etherchannel load balancing is configured via:
SW1(config)#port-channel load-balance ?
dst-ip Dst IP Addr
dst-mac Dst Mac Addr
src-dst-ip Src XOR Dst IP Addr
src-dst-mac Src XOR Dst Mac Addr
src-ip Src IP Addr
src-mac Src Mac Addr
- "src-mac": packets are distributed across the ports in the channel based on source mac-addresses of the incoming packet
- Packets from different host use differnt ports in the channel
- Packets from the same source host use the same port in the channel
- "dst-mac": packets are distributed across the ports in the channel based on the destination mac-addresses of the incoming packet
- Packets to the same destination are forwarded over the same port in the channel
- pakcets to different destinations are sent over differnet ports in the channel
- "src-dst-mac": distributes traffic across ports in the channel based on both source and destination mac-addresses
- Can be used when you are not sure whether source or destination mac-address forwarding may be better for a specific switch
- "src-ip": packets are distributed across the ports in the channel based on source IP address of the incoming packet
- Packets from different IP addresses use different ports
- Packets from the same IP use the same port
- "dst-ip": packets are distributed across the ports in the channel based on destination IP address of the incoming packet
- Packets from the source IP addresses to different destination could use different ports
- Packets from different source IP addresses to the same destination, are always sent on the same port in the channel
- "src-dst-ip": Distributes packets based on both the source and destination IP addresses of the incoming packet.
- Can be used if you are not clear whehter source IP or destination IP forwarding is better suited for this specific switch
- EtherChannel ensures a switch uses all available bandwidth available
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swethchl.html#wpxref12539
- EtherChannel balances traffic across the different links
- Load balancing can use MAC addresses or IP addresses, source or destination addresses or both source and destination addresses
- Selected load balancing mode is applied to all EtherChannel links configured on the switch
- Etherchannel load balancing is configured via:
SW1(config)#port-channel load-balance ?
dst-ip Dst IP Addr
dst-mac Dst Mac Addr
src-dst-ip Src XOR Dst IP Addr
src-dst-mac Src XOR Dst Mac Addr
src-ip Src IP Addr
src-mac Src Mac Addr
- "src-mac": packets are distributed across the ports in the channel based on source mac-addresses of the incoming packet
- Packets from different host use differnt ports in the channel
- Packets from the same source host use the same port in the channel
- "dst-mac": packets are distributed across the ports in the channel based on the destination mac-addresses of the incoming packet
- Packets to the same destination are forwarded over the same port in the channel
- pakcets to different destinations are sent over differnet ports in the channel
- "src-dst-mac": distributes traffic across ports in the channel based on both source and destination mac-addresses
- Can be used when you are not sure whether source or destination mac-address forwarding may be better for a specific switch
- "src-ip": packets are distributed across the ports in the channel based on source IP address of the incoming packet
- Packets from different IP addresses use different ports
- Packets from the same IP use the same port
- "dst-ip": packets are distributed across the ports in the channel based on destination IP address of the incoming packet
- Packets from the source IP addresses to different destination could use different ports
- Packets from different source IP addresses to the same destination, are always sent on the same port in the channel
- "src-dst-ip": Distributes packets based on both the source and destination IP addresses of the incoming packet.
- Can be used if you are not clear whehter source IP or destination IP forwarding is better suited for this specific switch
- EtherChannel ensures a switch uses all available bandwidth available
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swethchl.html#wpxref12539
Cisco CCNP:300-115 - 1.5 Configure and verify EtherChannels: 1.5.a LACP, PAgP, manual
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- Provides fault-tolerant high-speed links between switches, routers, etc
- If a link fails, traffic is redristubted to the remaining interfaces
- Provides up to 800 MB/s on Fast EtherChannel or 8 Gb/s (Gigabit EtherChannel)
- All ports must be either L2 or L3
- Up to 48 Etherchannels
- can be configured as PAgP, LACP or ON
- Both ends of the channel must use the same protocol to participate in the channel
- EtherChannel mode "on" means no negotiation but both sides must be configured for "on"
- Changes made to the port-channel interface is applied to all physical ports applied to the port-channel
- Configuration changes made to the physical port, only affects the port where the change was made
- Port Aggregation Protocol (PAgP)
- Cisco proprietary
- Can only run on Cisco devices or devices licensed by vendors
- Facilitates automatic creation of EtherChannel
- Similarly configured ports are grouped based on hardware, administrative, port parameter, etc. Basically similar speed, duplex, native VLAN, etc.
- The EtherChannel bundle is added to the spanning tree as a single switch port
PAgP Modes
- auto: This is a passive state in which the port only responds to PAgP packets but does not start PAgP negotiation
- desirable: this is an active negotiating state, in which the port actively tries to negotiate the channel
- Both "auto" and "desirable" allows for negotiation with partners to form an EtherChannel
- Ports can form EtherChannel even if they have different modes as long as the modes are compatabile.
- "desirable" and "auto" can negotiate a channel
- "desirable" and "desirable" can negotiate a channel
- Cisco CDP and DTP send and receive packets over the physical ports in the EtherChannel
- Trunk ports send and receive PAgP protocol data units (PDUs) on the lowest number VLAN
- In Layer 2 EtherChanne, the first port to come up provides the MAC address for the channel
- If the port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address for the EtherChannel
- PAgP sends and receive messages only on ports that are up and enabled for "auto" or "desirable"
Link Aggregation Control Protocol (LACP)
- LACP defined as IEEE 802.3ad
- Facilitates creation of EtherChannels between switches which support LACP
- Groups similarly configured ports into single link
- LACP adds the grouped ports to spanning tree as a single switch port
- LACP operates in two modes:
- active: Port is placed in "active" negotiating states
- passive: Port responds to receives packets but does not start negotiation
Ports can form EtherChannel once they are in compatible modes
- "active" and "active" can establish a tunnel
- "active" and "passive" can establish a tunnel
- "passive" and "passive" cannot establish a tunnel
- Cisco CDP and DTP send and receive packets over the physical ports in the EtherChannel
- Trunk ports send and receive LACP protocol data units (PDUs) on the lowest number VLAN
- In Layer 2 EtherChannel, the first port to come up provides the MAC address for the channel
- If the port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address for the EtherChannel
- PAgP sends and receive messages only on ports that are up and enabled for "auto" or "desirable"
- EtherChannel "on" mode
- Used to manually configure trunks linke
- No negotiations mechanism (PAgP or LACP) used
- Both ends of the switches must be configured as "on"
- All ports must have compatible characteristics
- Improperly configured EtherChannel ports are automatically disabled to avoid network loops and other problems
- Configuration tips
- No more than 48 EtherChannels should be configured
- PAgP should have no more than 8 Ethernet ports of the same type
- LACP EtherChannel can have up to 16 ports of the same type. However, only 8 are active while the other 8 are standby-cpu
- All ports should be at the same speed and duplex
- A port which is disabled using "shutdown" command is treated as a link failure and traffic is transferred to the other ports
- The following must be changed on all ports in the group:
- Spanning-tree path cost for each VLAN
- Spanning-tree port priority for each VLAN
- Spanning-tree Port fast setting
- A port should only be a member of 1 channel-group at a time
- Do not mix EtherChannel modes
- Do not configure a SPAN destination port as part of an EtherChannel
- Do not configure a secure port as part of the EtherChannel
- Do not confiure PVLAN on EtherChannel Port
- All ports must be in the same VLAN or must be configured as truks
- Ports with differnt native VLANs cannot form an EtherChannel
- All ports must use the same trunking protocol (ISL or IEEE 802.1Q)
- Allow range of VLANs must be the same
- Ports with different spaning-tree port can can for EtherChannel
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swethchl.html#wpxref12539
- Provides fault-tolerant high-speed links between switches, routers, etc
- If a link fails, traffic is redristubted to the remaining interfaces
- Provides up to 800 MB/s on Fast EtherChannel or 8 Gb/s (Gigabit EtherChannel)
- All ports must be either L2 or L3
- Up to 48 Etherchannels
- can be configured as PAgP, LACP or ON
- Both ends of the channel must use the same protocol to participate in the channel
- EtherChannel mode "on" means no negotiation but both sides must be configured for "on"
- Changes made to the port-channel interface is applied to all physical ports applied to the port-channel
- Configuration changes made to the physical port, only affects the port where the change was made
- Port Aggregation Protocol (PAgP)
- Cisco proprietary
- Can only run on Cisco devices or devices licensed by vendors
- Facilitates automatic creation of EtherChannel
- Similarly configured ports are grouped based on hardware, administrative, port parameter, etc. Basically similar speed, duplex, native VLAN, etc.
- The EtherChannel bundle is added to the spanning tree as a single switch port
PAgP Modes
- auto: This is a passive state in which the port only responds to PAgP packets but does not start PAgP negotiation
- desirable: this is an active negotiating state, in which the port actively tries to negotiate the channel
- Both "auto" and "desirable" allows for negotiation with partners to form an EtherChannel
- Ports can form EtherChannel even if they have different modes as long as the modes are compatabile.
- "desirable" and "auto" can negotiate a channel
- "desirable" and "desirable" can negotiate a channel
- Cisco CDP and DTP send and receive packets over the physical ports in the EtherChannel
- Trunk ports send and receive PAgP protocol data units (PDUs) on the lowest number VLAN
- In Layer 2 EtherChanne, the first port to come up provides the MAC address for the channel
- If the port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address for the EtherChannel
- PAgP sends and receive messages only on ports that are up and enabled for "auto" or "desirable"
Link Aggregation Control Protocol (LACP)
- LACP defined as IEEE 802.3ad
- Facilitates creation of EtherChannels between switches which support LACP
- Groups similarly configured ports into single link
- LACP adds the grouped ports to spanning tree as a single switch port
- LACP operates in two modes:
- active: Port is placed in "active" negotiating states
- passive: Port responds to receives packets but does not start negotiation
Ports can form EtherChannel once they are in compatible modes
- "active" and "active" can establish a tunnel
- "active" and "passive" can establish a tunnel
- "passive" and "passive" cannot establish a tunnel
- Cisco CDP and DTP send and receive packets over the physical ports in the EtherChannel
- Trunk ports send and receive LACP protocol data units (PDUs) on the lowest number VLAN
- In Layer 2 EtherChannel, the first port to come up provides the MAC address for the channel
- If the port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address for the EtherChannel
- PAgP sends and receive messages only on ports that are up and enabled for "auto" or "desirable"
- EtherChannel "on" mode
- Used to manually configure trunks linke
- No negotiations mechanism (PAgP or LACP) used
- Both ends of the switches must be configured as "on"
- All ports must have compatible characteristics
- Improperly configured EtherChannel ports are automatically disabled to avoid network loops and other problems
- Configuration tips
- No more than 48 EtherChannels should be configured
- PAgP should have no more than 8 Ethernet ports of the same type
- LACP EtherChannel can have up to 16 ports of the same type. However, only 8 are active while the other 8 are standby-cpu
- All ports should be at the same speed and duplex
- A port which is disabled using "shutdown" command is treated as a link failure and traffic is transferred to the other ports
- The following must be changed on all ports in the group:
- Spanning-tree path cost for each VLAN
- Spanning-tree port priority for each VLAN
- Spanning-tree Port fast setting
- A port should only be a member of 1 channel-group at a time
- Do not mix EtherChannel modes
- Do not configure a SPAN destination port as part of an EtherChannel
- Do not configure a secure port as part of the EtherChannel
- Do not confiure PVLAN on EtherChannel Port
- All ports must be in the same VLAN or must be configured as truks
- Ports with differnt native VLANs cannot form an EtherChannel
- All ports must use the same trunking protocol (ISL or IEEE 802.1Q)
- Allow range of VLANs must be the same
- Ports with different spaning-tree port can can for EtherChannel
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swethchl.html#wpxref12539
Cisco CCNP:300-115 - 1.4.b dot1Q
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- IEEE 802.1Q switches maintain one spanning-tree per VLAN0002
- Non-Cisco devices might support one spanning-tree instane for all VLANs
- Native VLANs need to be the same on both ends of the 802.1Q trunk
- If the Native VLAN is different on the links, spanning-tree loops might result
- Disabling spaning-tree on the native vlan without disabling spanning-tree on all other VLANs can cause spanning-tree loops
- Default interface mode is "dynamic auto"
- Default trunk encapsulation "negotiate"
- Allowed VLAN range 1 - 4094
- VLAN range eligible fo pruning 2 - 1001
- VLAN 1 is the default for all access ports
- VLAN 1 is the default native VLAN
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvlan.html
- IEEE 802.1Q switches maintain one spanning-tree per VLAN0002
- Non-Cisco devices might support one spanning-tree instane for all VLANs
- Native VLANs need to be the same on both ends of the 802.1Q trunk
- If the Native VLAN is different on the links, spanning-tree loops might result
- Disabling spaning-tree on the native vlan without disabling spanning-tree on all other VLANs can cause spanning-tree loops
- Default interface mode is "dynamic auto"
- Default trunk encapsulation "negotiate"
- Allowed VLAN range 1 - 4094
- VLAN range eligible fo pruning 2 - 1001
- VLAN 1 is the default for all access ports
- VLAN 1 is the default native VLAN
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvlan.html
Cisco CCNP:300-115 - 1.4 Configure and verify trunking: 1.4.a VTPv1, VTPv2, VTPv3, VTP pruning
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- Native VLANs
- Ports configured with IEEE 802.1Q tagging can receive both tagged and untagged traffic
- Switches forward untagged traffic in the native vlan by default
- VLAN 1 is the native VLAN by default
- The native VLAN can be assigned to any VLAN ID
- Configuring the native VLAN can be done via:
SW2(config-if)#switchport trunk native vlan 30
- Native VLANs
- Ports configured with IEEE 802.1Q tagging can receive both tagged and untagged traffic
- Switches forward untagged traffic in the native vlan by default
- VLAN 1 is the native VLAN by default
- The native VLAN can be assigned to any VLAN ID
- Configuring the native VLAN can be done via:
SW2(config-if)#switchport trunk native vlan 30
Cisco CCNP:300-115 - 1.4 Configure and verify trunking: 1.4.a VTPv1, VTPv2, VTPv3, VTP pruning
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- Pruning
- Increases network bandwidth by restricting flooded traffic to specific trunks
- Without pruning a switch flood broadcast, multicast and unknown unicast traffic across all trunk links within the VTP domain
- VTP pruning is disabled by default
- Pruning list only applies to trunk ports
- Each trunk port has its own eligibility list
- Only VLANs in the pruning-eligible list can be pruned
- By default VLANs 2-1001 are eligible to be pruned
- VTP pruning is supported in all versions of VTP
- Enabling VTP pruning on a VTP server enables pruning for the entire management domain
- Making VLANs pruning-eligible or pruning-ineligible affects pruning of those VLANs on that trunk only
- VLANs 1 and 1002-1005 are pruning-ineligible.
- Traffic from VLANs 1 and 1002-1005 cannot be pruned
- Extended range VLANs (1006-4094) are also pruning-ineligible
- Not designed to be used in VTP "Transparent" mode
- All switches in a VTP domain must have the same VTP domain name but does not need the same VTP version
- VTPv2 switches can operate in the same domain as a VTPv1 enable switch
- Switches which are capable of running VTPv2 but are running VTPv1 and receives a VTPv3 advertisements, will automatically move to VTPv2
- When a VTPv3 switch is connected to a switch running VTPv1, the VTPv1 swich moves to VTPv2 and the VTPv3 switch sends a scale down version of the Vtp packets so that the VTPv2 swich can update its database
- Switches running VTPv3 cannot be moved to VTPv2 or VTPv1 if using extended VLANs
- When VTPv2 is enaled on a switch in the VTP domain, all other switches within that domain enables VTPv2
- Two VTP versions 3 regions can only communicate in transparent mode over VTPv1 or v2
- VTP version 3 device does not accept configuration information from a VTP version 2 or version 1 device
- VTPv1 and VTPv2 does not support Private VLAN. If Private VLANs are configured, the switch must be in transparent mode
- VTPv3 supports Private VLAN
- Domain names cannot be removed but can be changed
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wpxref31101
- Pruning
- Increases network bandwidth by restricting flooded traffic to specific trunks
- Without pruning a switch flood broadcast, multicast and unknown unicast traffic across all trunk links within the VTP domain
- VTP pruning is disabled by default
- Pruning list only applies to trunk ports
- Each trunk port has its own eligibility list
- Only VLANs in the pruning-eligible list can be pruned
- By default VLANs 2-1001 are eligible to be pruned
- VTP pruning is supported in all versions of VTP
- Enabling VTP pruning on a VTP server enables pruning for the entire management domain
- Making VLANs pruning-eligible or pruning-ineligible affects pruning of those VLANs on that trunk only
- VLANs 1 and 1002-1005 are pruning-ineligible.
- Traffic from VLANs 1 and 1002-1005 cannot be pruned
- Extended range VLANs (1006-4094) are also pruning-ineligible
- Not designed to be used in VTP "Transparent" mode
- All switches in a VTP domain must have the same VTP domain name but does not need the same VTP version
- VTPv2 switches can operate in the same domain as a VTPv1 enable switch
- Switches which are capable of running VTPv2 but are running VTPv1 and receives a VTPv3 advertisements, will automatically move to VTPv2
- When a VTPv3 switch is connected to a switch running VTPv1, the VTPv1 swich moves to VTPv2 and the VTPv3 switch sends a scale down version of the Vtp packets so that the VTPv2 swich can update its database
- Switches running VTPv3 cannot be moved to VTPv2 or VTPv1 if using extended VLANs
- When VTPv2 is enaled on a switch in the VTP domain, all other switches within that domain enables VTPv2
- Two VTP versions 3 regions can only communicate in transparent mode over VTPv1 or v2
- VTP version 3 device does not accept configuration information from a VTP version 2 or version 1 device
- VTPv1 and VTPv2 does not support Private VLAN. If Private VLANs are configured, the switch must be in transparent mode
- VTPv3 supports Private VLAN
- Domain names cannot be removed but can be changed
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wpxref31101
Cisco CCNP:300-115 - 1.4 Configure and verify trunking: 1.4.a VTPv1, VTPv2, VTPv3, VTP pruning
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
Trunking
- Trunks are point-to-point links between one or more Ethernet switch interface and anotehr router router or switch
- Trunking can be done with 802.1Q
- 802.1Q tunnels maintain customer integrity across a service-provider network
- A 802.1Q tunnel port belongs to a single VLAN which is dedicated to tunnelling
- Ethernet trunks carry traffic of multiple VLANs over a single link
- VLANs can be extended across an entire VLAN
- The encapsulation protocols used for trunking are:
- Inter-switch Link (ISL): Cisco Proprietary
- 802.1Q: Industry standard truning
- negotiate: requires the interface to neogitate with its neighor on whether to use ISL (preferred) or 802.1Q
- Trunks can be configured on a single Ethernet interface or on EtherChannel bundle
- To autonegotiate trunking, the interfaces must be in the same VTP domain
- Trunking negotiation is managed by Dynamic Trunking Protocol (DTP), a point-to-point protocol
- DTP should be turned off on DTP interfaces which are connected to non-DTP interfaces
- When trunking is not desired use the "SW1(config-if)#switchport mode access" to disable trunking on the interface
- To force an interface to become a trunk without negotiating use: "SW1(config-if)#switchport mode trunk" and "SW1(config-if)#switchport nonegotiate"
- To configure an interface for 802.1Q encapsulation use: "SW1(config-if)#switchport trunk encapsulation dot1q"
- To configure an interface for ISL encapsulation use: "SW1(config-if)#switchport trunk encapsulation isl"
- DTP is not supported on private-VLANS ports or tunnel ports
- Trunking modes are:
- "dynamic auto"
- Interface is able to convert to a trunk link
- Interface becomes a trunk if the neighbor is "trunk" or "desirable"
- "dynamic desirable"
- The interface actively attempts to become a trunk link
- The interface becomes a trunk if its neighbor is in "trunk", "desirable" or "auto"
- "trunk"
- Interface is in permanent trunking mode
- Negotiate with the neighbor to become a trunk
- The interface becomes a trunk interface even if the neighbor is NOT trunk
- "nonegotiate"
- Prevents the interface from generating DTP frame.
- Should only be used when interface is a "access" or "trunk"
- Requires neighboring interface be configured manually as a trunk to establish the trunk link
- "dot1q-tunnel"
- Used for tunneling
- Used to maintain customer VLAN integrity across a service provider network
Modes that forms a tunnel:
- "trunk" and "trunk"
- "trunk" and "desirable auto"
- "trunk" and "dynamic desirable"
- "dynamic desirable" and "dynamic desirable"
- A trunk port is a member of all VLANs by default
- VLAN membership of VLANs can be influenced by the allowed-VLANs
- A trunk port cannot be a secure port
- A trunk port cannot be a tunnel port
- Trunk ports ca be groups into EtherChannel port groups
- All trunks in the EtherChannel group must have the same configuration
- When a trunk group is created, all ports follow the parameters et for the first port to be added to the group
- If configuration changes for:
- Allowed-Vlan list
- STP port priority for each VLAN
- STP Port Fast setting
- trunk status: If one gport in the EtherChannel group ceases to be a trunk, all ports ceases to be trunks
- Cisco recommends no more than 24 ports in PVST and no more than 40 trunk ports in MST mode
- Attempting to enable IEEE 802.1x on a trunk port results in an error message
- 802.1x cannot be enabled on trunk ports
- 802.1x ports cannot be changed to trunk
- Attempting to enable IEEE 802.1x on a dynamic port results in an error message
- 802.1x cannot be enabled on dynamic ports
- 802.1x ports cannot be changed to dynamic
- By default, traffic from all (1-4094) VLANs are allowed on a trunk link
- To restrict traffic from a trunk use:
SW2(config-if)#switchport trunk allowed vlan remove 30-40
- VLAN 1 can be removed on trunk to reduce the risk of spanning-tree loops or storms
- Even though VLAN 1 has been removed, the interface can continue to send and receive managemnet traffic such as CDP, PAgP, LACP, DTP and VTP
- Load sharing on trunk ports
- Divides the bandwidth supplied by parallel trunks connecting switches
- Divide the traffic between the links according to which VLAN the traffic belongs
- Load sharing is configured by leveraging STP port priorities or STP path costs
- When leveraging STP priorities for load sharing, both load sharing links must be connected to the same switch
- When leveraging STP path costs for load sharing, each load-sharing link can be connected to the same switch or to two different switches
Trunking
- Trunks are point-to-point links between one or more Ethernet switch interface and anotehr router router or switch
- Trunking can be done with 802.1Q
- 802.1Q tunnels maintain customer integrity across a service-provider network
- A 802.1Q tunnel port belongs to a single VLAN which is dedicated to tunnelling
- Ethernet trunks carry traffic of multiple VLANs over a single link
- VLANs can be extended across an entire VLAN
- The encapsulation protocols used for trunking are:
- Inter-switch Link (ISL): Cisco Proprietary
- 802.1Q: Industry standard truning
- negotiate: requires the interface to neogitate with its neighor on whether to use ISL (preferred) or 802.1Q
- Trunks can be configured on a single Ethernet interface or on EtherChannel bundle
- To autonegotiate trunking, the interfaces must be in the same VTP domain
- Trunking negotiation is managed by Dynamic Trunking Protocol (DTP), a point-to-point protocol
- DTP should be turned off on DTP interfaces which are connected to non-DTP interfaces
- When trunking is not desired use the "SW1(config-if)#switchport mode access" to disable trunking on the interface
- To force an interface to become a trunk without negotiating use: "SW1(config-if)#switchport mode trunk" and "SW1(config-if)#switchport nonegotiate"
- To configure an interface for 802.1Q encapsulation use: "SW1(config-if)#switchport trunk encapsulation dot1q"
- To configure an interface for ISL encapsulation use: "SW1(config-if)#switchport trunk encapsulation isl"
- DTP is not supported on private-VLANS ports or tunnel ports
- Trunking modes are:
- "dynamic auto"
- Interface is able to convert to a trunk link
- Interface becomes a trunk if the neighbor is "trunk" or "desirable"
- "dynamic desirable"
- The interface actively attempts to become a trunk link
- The interface becomes a trunk if its neighbor is in "trunk", "desirable" or "auto"
- "trunk"
- Interface is in permanent trunking mode
- Negotiate with the neighbor to become a trunk
- The interface becomes a trunk interface even if the neighbor is NOT trunk
- "nonegotiate"
- Prevents the interface from generating DTP frame.
- Should only be used when interface is a "access" or "trunk"
- Requires neighboring interface be configured manually as a trunk to establish the trunk link
- "dot1q-tunnel"
- Used for tunneling
- Used to maintain customer VLAN integrity across a service provider network
Modes that forms a tunnel:
- "trunk" and "trunk"
- "trunk" and "desirable auto"
- "trunk" and "dynamic desirable"
- "dynamic desirable" and "dynamic desirable"
- A trunk port is a member of all VLANs by default
- VLAN membership of VLANs can be influenced by the allowed-VLANs
- A trunk port cannot be a secure port
- A trunk port cannot be a tunnel port
- Trunk ports ca be groups into EtherChannel port groups
- All trunks in the EtherChannel group must have the same configuration
- When a trunk group is created, all ports follow the parameters et for the first port to be added to the group
- If configuration changes for:
- Allowed-Vlan list
- STP port priority for each VLAN
- STP Port Fast setting
- trunk status: If one gport in the EtherChannel group ceases to be a trunk, all ports ceases to be trunks
- Cisco recommends no more than 24 ports in PVST and no more than 40 trunk ports in MST mode
- Attempting to enable IEEE 802.1x on a trunk port results in an error message
- 802.1x cannot be enabled on trunk ports
- 802.1x ports cannot be changed to trunk
- Attempting to enable IEEE 802.1x on a dynamic port results in an error message
- 802.1x cannot be enabled on dynamic ports
- 802.1x ports cannot be changed to dynamic
- By default, traffic from all (1-4094) VLANs are allowed on a trunk link
- To restrict traffic from a trunk use:
SW2(config-if)#switchport trunk allowed vlan remove 30-40
- VLAN 1 can be removed on trunk to reduce the risk of spanning-tree loops or storms
- Even though VLAN 1 has been removed, the interface can continue to send and receive managemnet traffic such as CDP, PAgP, LACP, DTP and VTP
- Load sharing on trunk ports
- Divides the bandwidth supplied by parallel trunks connecting switches
- Divide the traffic between the links according to which VLAN the traffic belongs
- Load sharing is configured by leveraging STP port priorities or STP path costs
- When leveraging STP priorities for load sharing, both load sharing links must be connected to the same switch
- When leveraging STP path costs for load sharing, each load-sharing link can be connected to the same switch or to two different switches
Cisco CCNP:300-115 - 1.4 Configure and verify trunking: 1.4.a VTPv1, VTPv2, VTPv3, VTP pruning
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- VTP is a Layer 2 messaging protocol
- VTPv1 and v2 support standard VLAN range (1-100)
- VTPv3 supports the entire VLAN range (1-4094) which includes the extended VLAN range (1006-4094)
- VTPv3 cannot be converted to VTPv2 if extended VLANs are configured in the domain
- A switch can only be in one VTP domain
- Until a anagement domain name is learned or specified, you cannot create or modify VLANs on VTP server
- VLAN information not propogated on the network until a VTP domain name is specified or learned
- Switches uses the highest revision number to determine how to update its database
- "Transparent" mode allows for creation and modification of VLANs. However, those VLANs are not propogated to any other devices
- VTP modes include:
- Server:
- Allows for creation, modification and deletion of VLANs and other configuration parameters.
- VLAN configuration is saved in NVRAM
- Advertisements send to devices in the same VTP domain
- When a switch detects a failure when writint to NVRAM, the VTP mode automatically changes from "Server" to "client"
- Client:
- Receives and transmits learned updates
- Cannot create, delete or modify VLANs
- In VTPv1 and v2 VLAN config not saved in NVRAM.
- In VTPv3 configuration saved in NVRAM
- Transparent:
- Switches do not participate in VTP
- Does not advertise or synchronize its learned VLANs or configuration in VTPv1
- VTPv2 and v3 transparent mode allows for forwarding of VTP advertisements
- You can create, delete and modify VLANs
- If using VTPv1 or v2, the switch must be in VTP transparent mode when you create extended-range (1006-4094)
- VTPv3 support creatign extended-range VLANs while in client or server mode
- VTPv1 and v2 supports private VLAN but the switch must be in "transparent"
- VTPv3 supports private VLANs in client and server modes
- Configuration saved in NVRAM but not advertised to other switches
- Off:
- Functions much the same as a VTP transparent switch
- However, does not forward VTP advertisements on trunks
- VTP advertisements contain:
- VTP domain name
- VTP configuration revision numer
- Update identify and update timestamp
- MD5 digest VLAN configuration, which includes the MTU
- Frame format
- VTP Advertisements distribute the following for each configured VLAN:
- VLAN ID
- VLAN name
- VLAN type
- VLAN state
- Additonal VLAN configuration information specific to the VLAN type
- VTPv3 advertisements also include the primary server ID, an instance number and a start index
- By default VTP operates in v1
- VTPv2 supports Token Ring
- Unrecognized TLVs. These are stored in NVRAM when the switch is in VTP server mode
- VTPv2 version supports only one domain
- If the MD5 digest matches, the information is correct
- VTP Version 3
- Uses enhanced authentication via "hidden" or "secret"
- "hidden" saves the secret key from the password string in the VLAN database file but not in plaintext in the configuration
- "hidden" saves the hexadecimal key associated with the password in the running config
- "secret" allows for confiuration of the password secret key
- Supports extended VLAN range (1006-4094)
- If extended VLANs are configured you cannot convert from VTP v3 to v1 or v2
- VTP pruning still applies to VLANs 1-1005
- VLANs 1002-1005 are still reserved and cannot be modified
- supports private VLAN
- Supports any data in adomain
- Can also propogate Multiple Spanning Tree (MST) protocol database information
- A separate instance of VTP protocol runs for each application that uses VTP
- Uses the concept of Primary and secondary sever
- Primary server updates the database information
- Secondary servers can only backup updated VTP configuration received from the primary server to its NVRAM
- By devfault all devices come up as secondary servers
- To specify a primary server use:
SecurityNik#vtp primary
- You can have a working VTP domain without any primary servers
- The primary server status is lost if the device reload or domain paramaeters change
- Allows for turning VTP on or off on a trunk (per-port) basis
- VTP cannot be set to "off" for MST database
- VTP cannot be set to "on" for the VLAN database on the same port
- Setting VTP to "off" globally, applies it to all trunking ports in the system
- However can still set to "on" or "off" on a per-VTP instance basis
- VTP version 1 and 2 supports VTP modes "server", "client" and "transparent".
- VTP v3 supports one addition mode called "off". This means it support 4 modes, "off", "server", "client" and "transparent"
- VTP v1 and v2 supports only normal range VLANs (1-1005)
- the switch must be in VTP "transparent" mode if you create VLANs from 1006-4094
Only VTPv3 supports extended range (1006-4094) VLANs
- Cannot convert from VTPv3 to VTPv2 if exteded VLANs are configured in the domain
- For VTP to work, there must be a truk port on one switch connected to a trunk port on a second switch
- In VTPv1 and v2 the swtich must be in VTP "transparent" or "server" modes you can add, modify or remove configurations from VLANs 2-1001.
- VLANs 1, 1002-1005 are automatically created and cannot be removed
- In VTPv1 and v2, the switch must be in "transparent" mode when creating extended (1006-4094) VLANs
- Configuration for VLANs 101005 are stored in the "vlan.dat" file
- Attempting to manually delete the "vlan.dat" file may lead to inconsistency
- VLANs 1-1005 are always stored in "vlan.dat" file
- When the VTP mode is "transparent", the VLANs are stored in the switch running configuration
- To use VTP at least one trunk has to be established between two hosts
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvlan.html
https://learningnetwork.cisco.com/community/certifications/ccnp/switch_v2/exam-topics
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wpxref
https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010.html
- VTP is a Layer 2 messaging protocol
- VTPv1 and v2 support standard VLAN range (1-100)
- VTPv3 supports the entire VLAN range (1-4094) which includes the extended VLAN range (1006-4094)
- VTPv3 cannot be converted to VTPv2 if extended VLANs are configured in the domain
- A switch can only be in one VTP domain
- Until a anagement domain name is learned or specified, you cannot create or modify VLANs on VTP server
- VLAN information not propogated on the network until a VTP domain name is specified or learned
- Switches uses the highest revision number to determine how to update its database
- "Transparent" mode allows for creation and modification of VLANs. However, those VLANs are not propogated to any other devices
- VTP modes include:
- Server:
- Allows for creation, modification and deletion of VLANs and other configuration parameters.
- VLAN configuration is saved in NVRAM
- Advertisements send to devices in the same VTP domain
- When a switch detects a failure when writint to NVRAM, the VTP mode automatically changes from "Server" to "client"
- Client:
- Receives and transmits learned updates
- Cannot create, delete or modify VLANs
- In VTPv1 and v2 VLAN config not saved in NVRAM.
- In VTPv3 configuration saved in NVRAM
- Transparent:
- Switches do not participate in VTP
- Does not advertise or synchronize its learned VLANs or configuration in VTPv1
- VTPv2 and v3 transparent mode allows for forwarding of VTP advertisements
- You can create, delete and modify VLANs
- If using VTPv1 or v2, the switch must be in VTP transparent mode when you create extended-range (1006-4094)
- VTPv3 support creatign extended-range VLANs while in client or server mode
- VTPv1 and v2 supports private VLAN but the switch must be in "transparent"
- VTPv3 supports private VLANs in client and server modes
- Configuration saved in NVRAM but not advertised to other switches
- Off:
- Functions much the same as a VTP transparent switch
- However, does not forward VTP advertisements on trunks
- VTP advertisements contain:
- VTP domain name
- VTP configuration revision numer
- Update identify and update timestamp
- MD5 digest VLAN configuration, which includes the MTU
- Frame format
- VTP Advertisements distribute the following for each configured VLAN:
- VLAN ID
- VLAN name
- VLAN type
- VLAN state
- Additonal VLAN configuration information specific to the VLAN type
- VTPv3 advertisements also include the primary server ID, an instance number and a start index
- By default VTP operates in v1
- VTPv2 supports Token Ring
- Unrecognized TLVs. These are stored in NVRAM when the switch is in VTP server mode
- VTPv2 version supports only one domain
- If the MD5 digest matches, the information is correct
- VTP Version 3
- Uses enhanced authentication via "hidden" or "secret"
- "hidden" saves the secret key from the password string in the VLAN database file but not in plaintext in the configuration
- "hidden" saves the hexadecimal key associated with the password in the running config
- "secret" allows for confiuration of the password secret key
- Supports extended VLAN range (1006-4094)
- If extended VLANs are configured you cannot convert from VTP v3 to v1 or v2
- VTP pruning still applies to VLANs 1-1005
- VLANs 1002-1005 are still reserved and cannot be modified
- supports private VLAN
- Supports any data in adomain
- Can also propogate Multiple Spanning Tree (MST) protocol database information
- A separate instance of VTP protocol runs for each application that uses VTP
- Uses the concept of Primary and secondary sever
- Primary server updates the database information
- Secondary servers can only backup updated VTP configuration received from the primary server to its NVRAM
- By devfault all devices come up as secondary servers
- To specify a primary server use:
SecurityNik#vtp primary
- You can have a working VTP domain without any primary servers
- The primary server status is lost if the device reload or domain paramaeters change
- Allows for turning VTP on or off on a trunk (per-port) basis
- VTP cannot be set to "off" for MST database
- VTP cannot be set to "on" for the VLAN database on the same port
- Setting VTP to "off" globally, applies it to all trunking ports in the system
- However can still set to "on" or "off" on a per-VTP instance basis
- VTP version 1 and 2 supports VTP modes "server", "client" and "transparent".
- VTP v3 supports one addition mode called "off". This means it support 4 modes, "off", "server", "client" and "transparent"
- VTP v1 and v2 supports only normal range VLANs (1-1005)
- the switch must be in VTP "transparent" mode if you create VLANs from 1006-4094
Only VTPv3 supports extended range (1006-4094) VLANs
- Cannot convert from VTPv3 to VTPv2 if exteded VLANs are configured in the domain
- For VTP to work, there must be a truk port on one switch connected to a trunk port on a second switch
- In VTPv1 and v2 the swtich must be in VTP "transparent" or "server" modes you can add, modify or remove configurations from VLANs 2-1001.
- VLANs 1, 1002-1005 are automatically created and cannot be removed
- In VTPv1 and v2, the switch must be in "transparent" mode when creating extended (1006-4094) VLANs
- Configuration for VLANs 101005 are stored in the "vlan.dat" file
- Attempting to manually delete the "vlan.dat" file may lead to inconsistency
- VLANs 1-1005 are always stored in "vlan.dat" file
- When the VTP mode is "transparent", the VLANs are stored in the switch running configuration
- To use VTP at least one trunk has to be established between two hosts
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvlan.html
https://learningnetwork.cisco.com/community/certifications/ccnp/switch_v2/exam-topics
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wpxref
https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010.html
Cisco CCNP:300-115 - 1.3.c Normal, extended VLAN, voice VLAN
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- VLAN 1 (Normal Range): is Cisco default. This VLAN can be used but cannot be modified or deleted
- VLAN 2-1005 (Normal Range): can be used, created, modified and deleted as needed
- VLANS 1002 - 1005 is reserved for Token Ring and FDDI VLANs
- VLAN 1006-4094 (Extended Range): Can be created, used, and named.
- These are always in active state
- Always enabled by default and cannot be shutdown
- VLAN 3968 - 4047 and 4094 (Internally allocated): For internal use. Cannot be created, deleted or modified by you
- Voice VLAN port is an accept port attached to a Cisco IP phone and is configured to use one VLAN for voice traffic and another for data traffic
References:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/VLANs.html#48831
- VLAN 1 (Normal Range): is Cisco default. This VLAN can be used but cannot be modified or deleted
- VLAN 2-1005 (Normal Range): can be used, created, modified and deleted as needed
- VLANS 1002 - 1005 is reserved for Token Ring and FDDI VLANs
- VLAN 1006-4094 (Extended Range): Can be created, used, and named.
- These are always in active state
- Always enabled by default and cannot be shutdown
- VLAN 3968 - 4047 and 4094 (Internally allocated): For internal use. Cannot be created, deleted or modified by you
- Voice VLAN port is an accept port attached to a Cisco IP phone and is configured to use one VLAN for voice traffic and another for data traffic
References:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/VLANs.html#48831
Cisco CCNP:300-115 - 1.3 Configure and verify VLANs
Recently I needed to renew my Cisco CCNPs, that is both CCNP Routing and Switching as well as CCNP Security. While working with Cisco products (well now they own SourceFire, so exclude these) is not within my daily duties, I still thought it was important for me to maintain these two credentials. As a result, I've put together my notes below focusing on the key points I used to study. I believe that someone else may find them useful.
- Used to divie the network into separate logical area without regard for the physical location of the users
- Each VLAN is its own broadcast domain
- Any switch port can belong to a VLAN
- Unicast, broadcast and multicast packets are only forwarded and flooded to end stations in the VLAN
- Pakcets destined for stations not in the same VLAN must be forwarded via a router
- To communicate between VLANs traffic must be routed
- By default a new VLAN is operational or in an active state as in a "no shutdown" condition and thus can pass traffic
- If you try to create a VLAN with an existing VLAN ID, the switch goes into VLAN submode but does not create the same VLAN again
- Newly created VLANs remain unsused until ports are assigned to the specific VLAN
- By default all ports are in VLAN 1
- You may be able to configure a VLAN name and whether it is "shutdown" or not for all VLANs except VLAN 1
- When you delete a specific VLAN, the ports associated with that VLAN are shutdown and no traffic flows.
- Previously mapped ports which were assigned to VLANs that were deleted are remapped whenever that VLAN is recreated or reenable
- VLANs can be created in a single mode:
SW1(config)#vlan 30
SW1(config-vlan)#name SW1_VLAN_30
OR
- Creating a range of VLANs at once
SW1(config)#vlan 40-50
- Ports in a VLAN can b either physical Ethernet port or a port channel
To assign a port to a VLAN:
SW1(config)#int fa1/0/19
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 30
- To Verify the VLAN configuration we do
- SecurityNik#show running-config vlan
SecurityNik#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0/9, Fa1/0/11, Fa1/0/15
Fa1/0/16, Fa1/0/17, Fa1/0/18
Fa1/0/20, Fa1/0/21, Fa1/0/22
Fa1/0/23, Fa1/0/24, Gi1/0/1
Gi1/0/2
2 VLAN0002 active
......
30 SW1_VLAN_30 active Fa1/0/19
40 VLAN0040 active
SecurityNik#show vlan summary
Number of existing VLANs : 35
Number of existing VTP VLANs : 35
Number of existing extended VLANS : 0
References:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvlan.html
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/VLANs.html#48831
Subscribe to:
Posts (Atom)