Configuration Example

Virtual LANs

Virtual LANs (VLANs) enable network managers to group users logically rather than by physical location.

With VLANs, switches can support more than one subnet (or VLAN) on each switch, and can give routers and switches the opportunity to support multiple subnets on a single physical link. Layer 3 switching software supports VLAN frame encapsulation through implementation of the Inter-Switch Link (ISL) protocol and the IEEE 802.1Q standard. ISL is a Cisco protocol for interconnecting multiple switches and maintaining VLAN information as traffic travels between switches. The IEEE 802.1Q standard provides a method for secure bridging of data across a shared backbone.

Command	Purpose
Switch# configure terminal Switch(config)#	Enters global configuration mode.
Switch(config)# interface {gigabitethernet fastethernet} card/subcard/port.subinterface Switch(config-subif)#	Enters subinterface configuration mode.
Switch(config-subif)# encapsulation isl vlan-id or Switch(config-subif)# encap dot1q vlan-id native	Specifies ISL encapsulation for the Ethernet frames sent from this subinterface, with a header that maintains the specified VLAN ID between network nodes. or Specifies 802.1Q encapsulation for Ethernet frames sent from the subinterface, with a header that maintains the specified native VLAN ID between network nodes.
Switch(config-subif)# bridge-group bridge-group	Assigns the subinterface a bridge group number.
Switch(config-subif)# interface {gigabitethernet fastethernet} card/subcard/port Switch(config-if)#	Enters interface configuration mode to configure the Ethernet main interface.
Switch(config-if)# bridge-group bridge-group	Assigns the main interface to the bridge group.
Switch(config-if)# exit	Returns to global configuration mode.
Switch(config)# bridge bridge-group protocol ieee	Specifies that the bridge group will use the IEEE Ethernet Spanning Tree Protocol.

5-5

Example

Switch> enable

Switch# configure terminal

Switch(config)# interface gigabitethernet 0/0/1.1

Switch(config-subif)# encapsulation isl 50

Switch(config-subif)# bridge-group 1

Switch(config-subif)# interface gigabitethernet 11/0/0

Switch(config-if)# bridge-group 1

Switch(config-if)# exit

Switch(config)# bridge 1 protocol ieee

Switch(config)# interface fastethernet 10/0/1.2

Switch(config-subif)# encapsulation isl 100

Switch(config-subif)# bridge-group 2

Switch(config-subif)# interface fastethernet 9/0/2

Switch(config-if)# bridge-group 2

Switch(config-if)# exit

Switch(config)# bridge 2 protocol ieee

Switch(config)# exit

Switch# copy system:running-config nvram:startup-config

Verifying

Switch# show vlan 50

Virtual LAN ID: 50 (Inter Switch Link Encapsulation)

vLAN Trunk Interface: GigabitEthernet0/0/1.

Protocols Configured: Address: Received: Transmitted:

Bridging Bridge Group 1 0

Switch# more system:running-config

!

<Information deleted>

!

interface GigabitEthernet0/0/1.1

encapsulation isl 50

no ip redirects

no ip route-cache

bridge-group 1

!

<Information deleted>
      

Ether-Channel

EtherChannel is a logical aggregation of multiple Ethernet interfaces. EtherChannel is designed primarily for host-to-switch connectivity or Inter-Switch Link (ISL) switch-to-switch connectivity.

Configuring a Fast EtherChannel (FEC) or a Gigabit EtherChannel (GEC) consists of the following two-step process:

Step 1: Create an EtherChannel interface (port channel) and assign a network address.

Step 2: Assign the Fast Ethernet or Gigabit Ethernet interfaces (up to four) to the port channel.

When assigning interfaces to a specific port channel, the interfaces must all be Fast Ethernet, Gigabit Ethernet, or Enhanced Gigabit Ethernet. You cannot mix interface types within a single port-channel.

Command	Purpose
Switch> enable	Enters privileged EXEC mode.
Switch# configure terminal Switch(config)#	Enters global configuration mode.
Switch(config)# interface port-channel channel-number Switch(config-if)#	Creates the EtherChannel interface and enters interface configuration mode. The channel number can be from 1 to 64 for FECs and GECs.
Switch(config-if)# ip address ip-address subnet-mask	Assigns an IP address and subnet mask to the EtherChannel interface.
Switch(config-if)# no shutdown	Enables the EtherChannel interface.
Switch(config-if)# exit Switch(config)#	Exits interface configuration mode. Optionally, you can remain in interface configuration mode and enable other supported interface commands to meet your requirements.
Switch(config)# interface {gigabitethernet fastethernet} card/subcard/port Switch(config-if)	Enters interface configuration mode.
Switch(config-if)# no ip address	Disables the IP address. Note If the Fast Ethernet or Gigabit Ethernet interface already exists and has an IP address assigned, you must disable it before performing the next step. The Ethernet interface uses the IP address assigned to the EtherChannel interface.
Switch(config-if)# channel-group channel-number	Assigns the Fast Ethernet or Gigabit Ethernet interfaces to the EtherChannel. The channel number must be the same channel number you assigned to the EtherChannel interface.
Switch(config-if)# exit Switch(config)#	Returns to global configuration mode. Repeat Steps 7 through 9 to add up to four Fast Ethernet or Gigabit Ethernet interfaces to the Fast EtherChannel.
Switch(config)# end Switch#	Returns to privileged EXEC mode.
Switch# copy system:running-config nvram:startup-config	Saves your configuration changes to NVRAM.

Example

Switch> enable

Switch# configure terminal

Switch(config)# interface port-channel 5

Switch(config-if)# ip address 209.165.200.225 255.255.255.224

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface fastethernet 0/0/0

Switch(config-if)# no ip address

Switch(config-if)# channel-group 5

Switch(config-if)# end

Switch# copy system:running-config nvram:startup-config
      

HSRP

HSRP is a Cisco-proprietary protocol developed to allow several routers or multilayer switches to appear as a single gateway IP address for internal hosts.

HSRP Operation:

HSRP active router election is based on a priority value (0 to 255) that is configured on each router in the group. Default priority is 100. The router with the highest priority value (255 is highest) becomes the active router for the group. If all router priorities are equal or set to the default value, the router with the highest IP address on the HSRP interface becomes the active router. Active router, exchange HSRP hello messages
(to the multicast destination 224.0.0.2 using UDP port 1985) at regular intervals and only the standby router monitors the hello messages from the HSRP active router. By default, hellos are sent every 3 seconds. If hellos are missed for the duration of the holdtime timer (default 10 seconds, or three times the hello timer), the active router is presumed to be down. The standby router is then clear to assume the active role. At that point, if other routers are sitting in the Listen state, the next-highest priority router is allowed to become the new standby router.

A router can be configured as pre-empt to immediately take over the active role if its priority is the highest at any time. By default pre-empt is off.

HSRP Messages:

HSRP-configured routers exchange three types of multicast messages:

• Hello—Hello message conveys router's HSRP priority and state information to other HSRP routers. By default, an HSRP router sends hello messages every three seconds.
  
• Coup—When a standby router assumes the function of the active router, it sends a coup message.
  
• Resign—A router that is the active router sends this message when it is about to shut down or when a router that has a higher priority sends a hello message.
  

At any time, HSRP-configured routers are in one of the following states:

1. Active—The router is performing packet-transfer functions.

2. Standby—The router is prepared to assume packet-transfer functions if the active router fails.

3. Speaking and listening—The router is sending and receiving hello messages.

4. Listening—The router is receiving hello messages.

Configuration for Router A:

hostname RouterA

!

interface ethernet 0

ip address 1.0.0.1 255.0.0.0

standby 1 ip 1.0.0.3

standby 1 preempt

standby 1 priority 110

standby 1 authentication denmark

standby 1 timers 5 15

!

interface ethernet 1

ip address 3.0.0.1 255.0.0.0

!

router eigrp 1

network 1.0.0.0

network 3.0.0.0

Configuration for Router B:

hostname RouterB

!

interface ethernet 0

ip address 1.0.0.2 255.0.0.0

standby 1 ip 1.0.0.3

standby 1 preempt

standby 1 authentication denmark

standby 1 timers 5 15

!

interface ethernet 1

ip address 2.0.0.2 255.0.0.0

!

router eigrp 1

network 1.0.0.0

network 2.0.0.0

The standby ip interface configuration command enables HSRP and establishes 1.0.0.3 as the IP address of the virtual router. The configurations of both routers include this command so that both routers share the same virtual IP address. The 1 establishes Hot Standby group 1. (If you do not specify a group number, the default is group 0). The configuration for at least one of the routers in the Hot Standby group must specify the IP address of the virtual router; specifying the IP address of the virtual router is optional for other routers in the same Hot Standby group.

The standby preempt interface configuration command allows the router to become the active router when its priority is higher than all other HSRP-configured routers in this Hot Standby group at any time. The configurations of both routers include this command so that each router can be the standby router for the other router. The 1 indicates that this command applies to Hot Standby group 1. If you do not use the standby preempt command in the configuration for a router, that router cannot become the active router automatically.

The standby priority interface configuration command sets the router's HSRP priority to 110, which is higher than the default priority of 100. Only the configuration of Router A includes this command, which makes Router A the default active router. The 1 indicates that this command applies to Hot Standby group 1.

The standby authentication interface configuration command establishes an authentication string whose value is an unencrypted eight-character string that is incorporated in each HSRP multicast message. This command is optional. If you choose to use it, each HSRP-configured router in the group should use the same string so that each router can authenticate the source of the HSRP messages that it receives. The "1" indicates that this command applies to Hot Standby group 1.

The standby timers interface configuration command sets the interval in seconds between hello messages (called the hello time) to five seconds and sets the duration in seconds that a router waits before it declares the active router to be down (called the hold time) to eight seconds. (The defaults are three and 10 seconds, respectively.) If you decide to modify the default values, you must configure each router to use the same hello time and hold time. The "1" indicates that this command applies to Hot Standby group 1.

Configuration Commands

Switch(config-if)# standby group ip ip-address [secondary]

Switch(config-if)# standby group priority priority

Switch(config-if)# standby group timers [msec] hello [msec] holdtime

Switch(config-if)# standby group preempt [delay [minimum seconds] [reload seconds]]

Switch(config-if)# standby group authentication string

Switch(config-if)# standby group authentication md5 key-string [0 | 7] string

STP/ RSTP/ PVSTP

STP (Spanning Tree Protocol) 802.1D

STP is used to prevent L2 loops and at the same time provide redundancy. STP prevents loops in the network by assigning either the blocking or forwarding state on the ports. Hence with these two states STP provide redundancy as well as preventing loops in the network. This mechanism guarantees that there is one and only one active path between two network devices.

 

BPDU

BPDU are the messages which are exchanged between two switches. They are used to identify loops in the network as well as help in preventing them. Two types of BPDU are available configuration and topology change notification (TCN) BPDU. So when switch is in the election process it uses configuration BPDU, and TCN when there is a change occurs in the network. The default BPDU timer is 2 sec.

 

Bridge ID

Bridge ID has two parts BRIDGE PRIORITY & MAC Address. Bridge priority is a 2 Byte value ranges from 0-65535 and has the default value of 32768.

 

STP Timers:

STP uses 3 types of timers

• Hello: The time taken by Root Bridge to send configuration BPDU. Default Hello timer is 2 Sec.
  
• Forward delay: Time between the different port states of STP. Default Forward Delay timer is 15 Sec.
  
• Max Age: Time for which the switch will keep the information received from the root in its memory. Default Max Age timer is 20 Sec.
  

 

STP works

When a switch first power up it assumes that it is the Root Bridge itself and switch begins by sending out BPDUs with a Root Bridge ID and Sender ID equal to its own Bridge ID. As the BPDU goes out through the network, each switch compares its own BPDU with the one that switch receives from the neighbours. The comparison is done on bridge ID. When a switch hears of a better Root Bridge (lower bridge ID), it replaces its own Root Bridge ID with the Root Bridge ID announced in the BPDU although it still identifies itself as the Sender Bridge ID. After sometime the switch with the lowest bridge ID in the network wins this Root Bridge election process.

• STP Rule 1: All ports of the root bridge will be in forwarding mode.
  
  • Next, each switch determines the best path to get to the root. The switches determine this path based on Root Path Cost. This value is the cumulative cost of all the links leading to the Root Bridge. The switch uses the port with the least Root Path Cost in the BPDU in order to get to the root switch; the port with the least Root Path Cost in the BPDU is the root port.
    
• STP Rule 2: The root port must be set to forwarding mode.
  
  • In addition, the switches on each LAN segment communicate with each other to determine which switch is best to use in order to move data from that segment to the root bridge and this determination is based on the lowest cumulative Root Path Cost to the Root Bridge. And the port is called the designated port.
    
• STP Rule 3: The designated port must be set to forwarding mode.
  
• STP Rule 4: All the other ports in all the switches must be placed in blocking mode.
  

 

If two or more links might identical Root Path Costs then that will results in a tie condition. All tiebreaking STP decisions are based on the following sequence of four conditions:

• Lowest Root Bridge ID
  
• Lowest Root Path Cost to Root Bridge
  
• Lowest Sender Bridge ID
  
• Lowest Sender Port ID
  

 

STP PORT STATE:

• Blocking:
  

  All the port by default on a switch will be in the blocking state. In blocking state we are only allowed to receive BPDU. We can't build our MAC Table at this state.
  

• Listening:
  

  If the port on the switch is administratively enabled it move to listening state. At this state it can receive and transmit BPDU. Hence it involved in the election of Root Bridge. This state has a timer enabled which has to be elapsed before getting to the next state. This timer is called as forward delay timer and its default value is 15sec.
  

• Learning:
  

  At this state port can receive and transmit BPDU and also can start building MAC table. But it can't receive or transmit data frames at this state. This state also has forward delay timer and the default value of the timer is 15sec.
  

• Forwarding:
  

  At this state port can receive and transmit BPDU & DATA Frames and also we will continue to build our MAC table.
  

 

STP PORT ROLE

• Root port
  

  The most trusted port on the non root bridge is designed as root port. This port is closed to the root bridge.
  

• Designated port
  

  Designated port is the port that has the most trusted information or we can say designated port transmits the most trusted BPDU. Designated port sends BPDU to the root port.
  

• Blocking port
  
  • Alternate port
    

    This port receives the better BPDU from another bridge.
    

  • Backup port
    

    This port receives the better BPDU from the same bridge.
    

 

RSTP (Rapid Spanning Tree Protocol) 802.1w

It has bundled 802.1d with some additional features which are used to speed up the boot up time of the switch. The additional features are uplink fast, backbone fast, port fast.

 

PORT STATE                PORT ROLE

Discarding                Root

Learning                Designated

Forwarding                Blocking (Alternate, Back-up)

 

ENHANCEMENT

• Non-root Bridge can generate BPDU
  

  In RSTP non-root port are allowed to generate the BPDU and they generate the BPDU on every hello second which is by default sets to 2sec. we use this method to enable fast aging process i.e. if a switch misses the 3 hello BPDU from the non root-bridge it will remove all the path learned via that switch.
  

• Back-bone fast (inferior BPDU)
  

  If the link between any two switches fails, and they don't have any other link to reach out. In such case they use inferior BPDU. So as soon as a switch sees that my best BPDU is not receiving it switches its path from best one to inferior one. And allow network to convergence fast.
  

• Port-fast
  

  In this switch is defined by two additional ports edge & point-to-point port.
  

  • Edge-port is a port which doesn't have any L2 device connected to it. It means it can have a PC connecting to it. So, in such the port will move directly from blocking state to forwarding and hence preventing listing and learning state i.e. saving 30secs. And whenever a port fast port receives a BPDU, the port fast feature will get disabled and normal STP process will take place.
    
  • Point-to-point link is a link which has only 2 switch connected, even in such situation we can skip listing and learning stage and can save 30secs. The switch will identify the Point-to-point link if their ports are in full-duplex mode.
    
• Uplink fast
  

In this method if switch root port gets down then we can use alternate port to reach to the destination. Hence we can speed up the conversation.

 

Loop Guard

The loop guard is intended to provide additional protection against L2 forwarding loops (STP loops). An STP loop is created when an STP blocking port in a redundant topology erroneously transitions to forwarding state. This usually happens because one of the ports of a physically redundant topology (not necessarily the STP blocking port) stopped receiving STP BPDUs.

In its operation, STP relies on continuous reception or transmission of BPDUs, depending on the port role (designated port transmits, non-designated port receives BPDUs).

When one of the ports in a physically redundant topology stops receiving BPDUs, the STP conceives the topology as loop free. Eventually, the blocking port from the alternate or backup port becomes designated, and moves to forwarding state, thus creating a loop.

With the loop guard, an additional check is made. If BPDUs are not received any more on a non-designated port and the loop guard is enabled, that port will be moved into the STP loop-inconsistent blocking state instead of moving to the forwarding state. Without the loop guard, the port would assume the designated port role and move to STP forwarding state, and thus create a loop.

Loop guard should be enabled on the non-designated & blocking ports (more precisely, on root and alternate ports) for all possible combinations of active topologies.

 

Root guard

The root guard feature is used to enforce the root bridge placement in the network.

The root guard ensures that the port on which root guard is enabled is the designated port. If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port, root guard moves this port to a root-inconsistent STP state. This root-inconsistent state is effectively equal to a listening state. No traffic is forwarded across this port. In this way, the root guard enforces the position of the root bridge.

Whenever the root guard feature is enabled, no traffic passes through the root-inconsistent STP port in this state. After device ceases to send superior BPDUs, the port is unblocked again. Via STP, the port goes from the listening state to the learning state, and eventually transitions to the forwarding state. Recovery is automatic; no human intervention is necessary.

You must enable root guard on all ports where the root bridge should not appear. In a way, you can configure a perimeter around the part of the network where the STP root is able to be located.

 

BPDU Guard

Whenever we have a port fast feature enabled, the port will directly go in forwarding state from blocking but when it encounters a BPDU on that port it will loose its port fast feature and will start working as normal STP. But if we have BPDU Guard enabled on that interface the port will not disabled port fast where as it will shut down that port for further communication.

 

PVST (Per-VLAN Spanning Tree)

Per-VLAN Spanning Tree (PVST) is a CISCO proprietary version of STP and maintains a spanning tree instance for each VLAN configured in the network. It uses ISL Trunking and allows a VLAN trunk to be forwarding for some VLANs while blocking for other VLANs. Since PVST treats each VLAN as a separate network, it has the ability to load balance traffic (at layer-2) by forwarding some VLANs on one trunk and other VLANs on another trunk without causing a Spanning Tree loop.

 

PVST+ (Per-VLAN Spanning Tree Plus)

Per-VLAN Spanning Tree Plus is a proprietary version of STP that allows devices to interoperate with both PVST and CST. In networks where PVST and CST coexist, interoperability problems occur because each requires a different trunking method, so BPDUs are never exchanged between STP types and CST.

To do this, PVST+ acts as a translator between groups of CST switches and groups of PVST switches. PVST+ can communicate directly with PVST by using ISL trunks. To communicate with CST, however, PVST+ exchanges BPDUs with CST as untagged frames over the native VLAN.