Building Converged Cisco Multilayer Switched Networks (BCMSN) LearnSmart Exam Manual

Transcription

1

2 Maual BCMSN Buildig Coverged Cisco Multilayer Switched Networks (BCMSN) LearSmart Maual Copyright 2011 by PrepLogic, LLC Product ID: Productio Date: July 19, 2011 All rights reserved. No part of this documet shall be stored i a retrieval system or trasmitted by ay meas, electroic, mechaical, photocopyig, recordig, or otherwise, without writte permissio from the publisher. No patet liability is assumed with respect to the use of the iformatio cotaied herei. Warig ad Disclaimer Every effort has bee made to make this documet as complete ad as accurate as possible, but o warraty or fitess is implied. The publisher ad authors assume o resposibility for errors or omissios. The iformatio provided is o a as is basis. The authors ad the publisher shall have either liability or resposibility to ay perso or etity with respect to ay loss or damages arisig from the iformatio cotaied i this documet. LearSmart Cloud Classroom, LearSmart Video Traiig, Pritables, Lecture Series, Quiz Me Series, Awdeeo, PrepLogic ad other PrepLogic logos are trademarks or registered trademarks of PrepLogic, LLC. All other trademarks ot owed by PrepLogic that appear i the software or o the Web Site (s) are the property of their respective owers. Volume, Corporate, ad Educatioal Sales Favorable discouts are offered o all products whe ordered i quatity. For more iformatio, please cotact us directly: solutios@learsmartsystems.com Iteratioal Cotact Iformatio Iteratioal: +1 (813) Uited Kigdom: (0) LearSmart Cloud Classroom: Video Traiig Mauals

3 Maual BCMSN Table of Cotets Abstract...5 Your Product...5 About the Author...5 Implemetig VLANs...6 VLANs i a Hierarchical Network...6 Cofigurig VLANs...7 VLAN Trukig...8 Cofigurig ISL Truks...8 Cofigurig 802.1q Truks...11 VLAN Trukig Protocol (VTP)...13 Cofigurig VTP...13 VLAN Pruig...17 Spaig Tree Protocol (STP)...17 Spaig Tree Protocols i a Hierarchical Network...17 Cofigurig PVRST...18 Cofigurig MISTP...23 STP Mechaisms PortFast...25 BPDU Guard...25 BPDU Filterig...25 UDLD...26 Loop Guard...26 Root Guard...27 Lik Aggregatio (EtherChael)...27 Layer 2 EtherChael...27 Layer 3 EtherChael...28 EtherChael Load Balacig...28 EtherChael o Cofiguratio...28 PAgP Cofiguratio...30 LACP Cofiguratio...32 Iter-VLAN Routig...34 Explaatio of Iter-VLAN Routig...34 Cofigurig Iter-VLAN Routig...34 LearSmart Cloud Classroom: Video Traiig Mauals

4 Maual BCMSN Explai ad Eable CEF...39 Gateway Redudacy Techologies...40 HSRP...40 VRRP...42 GLBP...45 Wireless Stadards...48 Data, Throughput ad Coverage of Stadards...48 Compoets ad Operatios of WLAN Topologies...49 Cisco Recommeded Desigs...50 Wireless Mobility...51 Cofigurig a Wireless Cliet...52 Security Features i a Switched Network...58 MAC Address Floodig Port Security x Autheticatio...59 Address Resolutio Protocol (ARP) Spoofig...59 Static ARP Etries...60 Dyamic ARP Ispectio (DAI)...60 Private VLANs (PVLAN)...61 VLAN Hoppig...61 Cofigure Support for Voice...63 Characteristics of Voice i the Campus Network...63 Fuctios of Voice VLANs ad Trust Boudaries...63 Voice VLAN Cofiguratio ad Verificatio...64 LearSmart Cloud Classroom: Video Traiig Mauals

5 Maual BCMSN Abstract The Cisco Certified Network Professioal is oe of the most well respected certificatios i the world. By attaiig it, studets ad cadidates sigify themselves as extremely accomplished ad capable Network Professioals. These four exams, created by Cisco Systems, are extremely difficult ad ot to be take lightly. They cover a myriad of topics, i particular - the BCMSN (Buildig Coverged Cisco Multilayer Switched Networks) exam covers all the way to the most detailed aalysis of routig packets across multiple subetted etworks, icludig VLANs ad other complex etwork cocepts. BCMSN is multiple choice, simulative, ad icorporates test strategies such as drag ad drop ad hot area questios to verify a cadidate s kowledge. Before takig this exam, you should be very familiar with both Cisco techology ad etworkig. You must have also attaied the Cisco CCNA certificatio by passig either the oe or two part path. Your Product This BCMSN Maual has bee desiged from the groud up with you, the studet, i mid. It is lea, strog, ad specifically targeted toward the cadidate. Ulike may other BCMSN products, the Lear- Smart BCMSN Maual does ot waste time with excessive explaatios. Istead, it is packed full of valuable techiques, priceless iformatio, ad brief, but precisely worded, explaatios. While we do ot recommed usig oly this product to pass the exam, but rather a combiatio of LearSmart Audio Traiig,, ad Video Traiig, we have desiged the product so that it ad it aloe ca be used to pass the exam. About the Author Adrew Froehlich: CCNP, CCSP, CCDA Adrew is the Presidet of West Gate Networks, a etwork ad IT cosultig firm based i Chicago. He has over 10 years of techology experiece with 8 of those years focused o etwork ad IT security related solutios. His expertise i etwork techologies icludes: LAN/WAN architecture, remote access, VPNs, wireless techologies, voice services, ad etwork security. Froehlich s past ad preset experiece icludes etwork desig ad troubleshootig with major fiacial istitutios, health care providers ad airlies. LearSmart Cloud Classroom: Video Traiig Mauals

6 Maual BCMSN Implemetig VLANs VLANs i a Hierarchical Network A virtual LAN (VLAN) is a logical etwork that allows a group of devices to act as if they are o the same physical etwork. All devices withi a VLAN share the same uicast, broadcast ad multicast domai. Networked devices ca be coected to differet switches i differet locatios ad still be o the same VLAN. This allows for a great amout of flexibility as see i Figure 1. Commuicatio betwee VLANs must pass through a layer 3 device such as a router. VLAN 100 VLAN 200 VLAN 300 Switch 1 Switch 2 Switch 3 Figure 1 All devices withi a particular VLAN are typically i the same IP subet. For example, all PC s i VLAN 100 have a IP address withi the X/24 rage while PC s i VLAN 200 have a IP address of X/24. The IP subet is cofigured either o a router iterface or a Layer 3 switch VLAN iterface. These VLAN iterfaces are also kow as switch virtual iterfaces (SVI). I a typical 3 tier Cisco architecture, the VLAN SVIs are cofigured at the distributio layer. That effectively creates the layer 3 gateways o the VLAN iterfaces. Layer 2 physical iterfaces are the cofigured to coect to the access layer switches. If multiple VLANs are required o a particular switch, a truk is cofigured to switch multiple VLANs across the same physical coectio. LearSmart Cloud Classroom: Video Traiig Mauals

7 Maual BCMSN Cofigurig VLANs The Cisco recommeded method to create ad verify a VLAN is as follows: Sytax: Switch# cofigure termial Switch(cofig)# vla vla-id Switch(cofig-vla)# ame vla-ame Switch(cofig-vla)# ed Switch# show vla {ame vla-ame id vla-id} So let s say that we wat to create VLAN 200 o our switch ad ame it Accoutig. Here s how it would be cofigured: ple: Switch# cofigure termial Switch(cofig)# vla 200 Switch(cofig-vla)# ame Accoutig Switch(cofig-vla)# ed Switch# show vla Accoutig (or show vla 200) A secod method that ca be used o a Cisco switch is by eterig the VLAN database i privileged EXEC mode: Sytax: Switch# vla database Switch(vla)# vla vla-id ame vla-ame Switch(vla)# exit Switch# show vla {ame vla-ame id vla-id} So to create a VLAN 200 with the ame Accoutig usig the VLAN database method, it would look like this: Switch# vla database Switch(vla)# vla 200 ame Accoutig Switch(vla)# exit Switch# show vla Accoutig (or show vla 200) Note: You caot add exteded-rage VLANs i VLAN database cofiguratio mode Normal-rage vlas are with beig reserved for toke-rig VLANs. Exteded-rage VLANs ( ) are cofigured usig the cofig-vla method. LearSmart Cloud Classroom: Video Traiig Mauals

8 Maual BCMSN Now that we kow how to build a VLAN, we ca cofigure specific switch iterfaces so ed devices ca become part of the VLAN. By default, all switch ports are placed i VLAN 1. There are multiple ways to assig VLAN membership to a port. The first ad most widely used method is static assigmet. Below is the sytax to statically assig a port to a VLAN ad verify the cofiguratio: Sytax: Switch# cofigure termial Switch(cofig)# iterface iterface-id Switch(cofig-if )# switchport mode access Switch(cofig-if )# switchport access vla vla-id Switch(cofig-if )# ed Switch# show iterfaces iterface-id switchport Usig our example above, let s statically assig switch port fa0/10 to VLAN 200: ple: Switch# cofigure termial Switch(cofig)# iterface fastetheret0/10 Switch(cofig-if )# switchport mode access Switch(cofig-if )# switchport access vla 200 Switch(cofig-if )# ed VLAN Trukig Whe coectig multiple switches together, a truk lik ca be used to trasport traffic from multiple VLANs across a sigle poit-to-poit lik. This is called a truk lik. There are two ways to cofigure a truk o Cisco devices. Cisco has their ow proprietary trukig protocol called Iter-switch lik (ISL). The other method is 802.1q which is a o-proprietary IEEE stadard. Cofigurig ISL Truks The Iter-switch lik protocol is a method of taggig a switch frame with the VLAN idetificatio umber so coected switches ca idetify the VLAN umberig correctly ad to trasfer ed device commuicatio from oe switch to aother o the same VLAN. ISL prepeds a 26 byte header, icludig a 10 bit VLAN ID, to the frame header. It also appeds a 4 byte CRC to the ed of the frame. This effectively ecapsulates the VLAN tagged frame. There are three steps to cofigurig a ISL truk lik o each side of the switch. The steps are: 1. Set the truk ecapsulatio 2. Set the truk mode 3. Set the default VLAN The truk ecapsulatio method must be the same o both sides of the truk. A truk port ca be cofigured to egotiate the ecapsulatio method usig the egotiatio commad. The mode ca be hard-coded to truk or use the dyamic desirable/ dyamic auto methods to dyamically trasitio to a trukig state. If both sides of the lik are set to dyamic desirable, a truk will form. If both sides are set to auto, the truk will ot form. If oe side of the truk is auto ad the other is desirable, the truk will form. Ad if oe side is set to truk while the other is either desirable or auto, the truk will form. The default mode for switch iterfaces is dyamic desirable. LearSmart Cloud Classroom: Video Traiig Mauals

9 Maual BCMSN The default VLAN commad is optioal but is a good idea to do. It dictates what VLAN is used if the iterface stops trukig. This is importat if your truk liks are set to dyamic desirable or dyamic auto. Figure 2 will serve as the example to cofigurig a ISL truk betwee 2 switches. VLANs 100 ad 200 are cofigured o both of the switches ad we wat the VLANs to be truked usig ISL for seamless commuicatio of ed devices o the same VLAN. Fa0/1 Fa0/1 wg1 wg2 Figure 2 Sytax: Switch# cofigure termial Switch(cofig)# iterface iterface-id Switch(cofig-if )# switchport truk ecapsulatio {isl dot1q egotiate} Switch(cofig-if )# switchport mode {dyamic {auto desirable} truk} Switch(cofig-if )# switchport access vla vla-id The mode ca be hard-coded to truk or use the dyamic desirable/dyamic auto methods to dyamically trasitio to a trukig state. If both sides of the lik are set to dyamic desirable, a truk will form. If both sides are set to auto, the truk will ot form. If oe side of the truk is auto ad the other is desirable, the truk will form. Ad if oe side is set to truk while the other is either desirable or auto, the truk will form. The default mode for switch iterfaces is dyamic desirable. The default VLAN commad is optioal but is a good idea to do. It dictates what VLAN is used if the iterface stops trukig. This is importat if your truk liks are set to dyamic desirable or dyamic auto. ple: Because we kow we wat a ISL truk lik betwee wg1 ad wg2 i Figure 2, the ecapsulatio will be set to ISL ad the mode will be hard-coded to truk o both sides. Eve though the port will be hardcoded the default VLAN will be set to 100. Switch wg1: wg1# cofigure termial wg1(cofig)# iterface fa0/1 wg1(cofig-if )#switchport truk ecapsulatio isl wg1(cofig-if )#switchport mode truk wg1(cofig-if )#switchport access vla 100 LearSmart Cloud Classroom: Video Traiig Mauals

10 Maual BCMSN Switch wg2: wg2# cofigure termial wg2(cofig)# iterface fa0/1 wg2(cofig-if )#switchport truk ecapsulatio isl wg2(cofig-if )#switchport mode truk wg2(cofig-if )#switchport access vla 100 To verify our truk we ca do a show iterfaces truk: wg1#show iterfaces truk Port Mode Ecapsulatio Status Native vla Fa0/1 o isl trukig 1 Port Vlas allowed o truk Fa0/ Port Vlas allowed ad active i maagemet domai Fa0/1 1,100,200 Port Vlas i spaig tree forwardig state ad ot prued Fa0/1 1,100,200 The output shows that the truk status is turkig with ISL ecapsulatio. All VLANs that are cofigured o the switches are allowed to traverse the truk but oly VLAN 1, 100 ad 200 are curretly active o the switch. To limit the VLANs that are used o the truk, the switchport truk allowed vla vla-id commad could be used. I our example, we wat to limit the VLANs truked to 100 ad 200. wg1(cofig-if )#switchport truk allowed vla 100,200 Now, lookig at the show iterfaces truk commad, we see that oly the two VLANs are allowed. wg1#show iterfaces truk Port Mode Ecapsulatio Status Native vla Fa0/1 o isl trukig 1 Port Vlas allowed o truk Fa0/1 100,200 Port Vlas allowed ad active i maagemet domai Fa0/1 100,200 Port Vlas i spaig tree forwardig state ad ot prued Fa0/1 100,200 LearSmart Cloud Classroom: Video Traiig Mauals

11 Maual BCMSN Aother useful commad is show VLAN brief. This commad shows what switchports the ports are cofigured for: wg1#sh vla brief VLAN Name Status Ports default active 100 VLAN0100 active Fa0/2, Fa0/3, Fa0/4, Fa0/5 Fa0/6, Fa0/7, Fa0/8, Fa0/9 Fa0/10, Fa0/11, Fa0/12, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/18, Fa0/19, Fa0/20, Gi0/1 200 VLAN0200 active Fa0/21, Fa0/22, Fa0/23, Fa0/24 Fa0/25, Fa0/26, Fa0/27, Fa0/28 Fa0/29, Fa0/30, Fa0/31, Fa0/32 Fa0/33, Fa0/34, Fa0/35, Fa0/36 Fa0/37, Fa0/38, Fa0/39, Fa0/40 Fa0/41, Fa0/42, Fa0/43, Fa0/44 Fa0/45, Fa0/46, Fa0/47, Fa0/48 Gi0/ fddi-default act/usup 1003 toke-rig-default act/usup 1004 fddiet-default act/usup 1005 tret-default act/usup You ll otice that all the switchports are cofigured to belog i either vla 100 or 200. But our Fa0/1 truk port is missig. This is because the truk will oly belog to a sigle VLAN if the port stops trukig. Cofigurig 802.1q Truks Cofigurig 802.1q truks is very similar. The 802.1q trukig stadard does ot add a VLAN tag to the frame. Istead, it iserts a 4 byte tag ito the frame itself. Figure 3 will be our example used for cofigurig 802.1q trukig. The 4 steps for cofigurig 802.1q trukig are: 1. Set the truk ecapsulatio 2. Set the truk mode 3. Set the default VLAN 4. Set the ative VLAN The first 3 steps are idetical to the ISL truk except you set the ecapsulatio to dot1q. The ative VLAN assiged to the 802.1q truk lik must be idetical o both sides. Fa0/1 Fa0/1 wg1 wg2 Figure 3 LearSmart Cloud Classroom: Video Traiig Mauals

12 Maual BCMSN Sytax: ple: Switch# cofigure termial Switch(cofig)# iterface iterface-id Switch(cofig-if )# switchport truk ecapsulatio {isl dot1q egotiate} Switch(cofig-if )# switchport mode {dyamic {auto desirable} truk} Switch(cofig-if )# switchport access vla vla-id Switch(cofig-if )# switchport truk ative vla vla-id This time, we ll cofigure both sides to ecapsulate usig dot1q. The modes o both sides will be set to hard-code with truk. Ad fially, the ative VLAN will be set to 100. Switch wg1: Switch wg2: wg1# cofigure termial wg1(cofig)# iterface fa0/1 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#switchport access vla 100 wg1(cofig-if )#switchport truk ative vla 100 wg2# cofigure termial wg2(cofig)# iterface fa0/1 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#switchport access vla 100 wg2(cofig-if )#switchport truk ative vla 100 To verify our truk we ca do a show iterfaces truk: wg1#show iterfaces truk Port Mode Ecapsulatio Status Native vla Fa0/1 o 802.1q trukig 100 Port Vlas allowed o truk Fa0/ Port Vlas allowed ad active i maagemet domai Fa0/1 1,100,200 Port Vlas i spaig tree forwardig state ad ot prued Fa0/1 1,100,200 You ca see that the 802.1q truk is up with the ative vla of 100. If you wat to limit what VLANs are allowed o the truk, you ca use the switchport truk allowed vla vla-id commad just like the ISL truk. LearSmart Cloud Classroom: Video Traiig Mauals

13 Maual BCMSN VLAN Trukig Protocol (VTP) VLAN trukig protocol (VTP) is a way to simplify maagemet of VLANs o a etwork. The setup allows a egieer to add, delete or edit VLAN s i a sigle locatio ad have that iformatio propagated to all switches withi a VTP domai. There are three ways to cofigure VTP o Cisco devices. The switch ca be defied as a server, cliet or trasparet. VTP Server: This mode allows a egieer to add, delete ad modify VLANs. This is the default VTP mode for switches. VTP Cliet: This mode listes to VTP server messages ad copies the settigs of the switch that is cofigure with the server VTP mode. No chages ca be made o a switch that is cofigured as a cliet. VTP Trasparet: These switches do ot liste to VTP messages at all. They ca add, delete ad chage VLAN iformatio o the local switch but it does ot propagate the iformatio to ay other switch like the server would. VTP advertisemets are set across ISL ad 802.1q truks to other switches i the same VTP domai. If a switch is listeig to VTP advertisemets ad receives a message with a revisio umber that is lower tha the oe it is curretly o, it will igore the message all together. The VTP revisio umber icremets each time a VLAN chage is made o the etwork. This helps to prevet a ew switch beig added oto the etwork that is set for VTP mode server. If the ew switch is ot cofigured properly with the curret VLAN iformatio o the etwork, it ca wipe out all VTP iformatio. It is importat to remember that whe addig a ew switch set for VTP server mode to the etwork that it has bee rebooted prior to coectig it to a productio etwork as the revisio umber might be higher ad will delete all of your VLANs! Whe cofigurig VTP for the first time o a etwork, it is importat to remember a few cosideratios. The first cosideratio is to ote that truk egotiatio does ot work across VTP domais. All switches eed to be withi a VTP domai to participate. The VTP versio must also be idetical across a VTP domai. The default VTP versio is 2. Ad fially, the VTP servers i the domai should all have the same revisio umber ad they should be the highest umber of all the switches. By default, VTP is disabled. To eable VTP, you have to cofigure a VTP domai ame. A VTP password ca also be used ad is recommeded. All participatig switches i the VTP domai must have idetical passwords. VTP pruig ca also be tured o to allow for fewer VTP advertisemets to be set. If a VTP message comes through about a VLAN that is ot cofigured o ay ports of the dowstream switch, VTP pruig figures this out ad does ot sed the message to that particular switch. Note that oly VLANs are prue eligible. Pruig is disabled by default ad VLANs must be cofigured to be prue eligible. Cofigurig VTP I our Figure 4 example, we ll cofigure switch wg1 as the VTP server that will propagate all VLAN iformatio to the two switches that are cofigured as VTP Cliets. Assume the switches are already cofigured for 802.1q trukig ad have VLAN 100 ad 200 already cofigured. The ative VLAN is set as 100. LearSmart Cloud Classroom: Video Traiig Mauals

14 Maual BCMSN Fa0/1 Fa0/2 wg 3 Fa0/1 Fa0/1 Fa0/2 Fa0/2 wg1 wg2 Figure 4 Prior to ay VTP cofiguratios beig made, this is the status of our VTP: wg3#show vtp status VTP Versio : 2 Cofiguratio Revisio : 4 Maximum VLANs supported locally : 1005 Number of existig VLANs : 7 VTP Operatig Mode : Server VTP Domai Name : VTP Pruig Mode : Disabled VTP V2 Mode : Disabled VTP Traps Geeratio : Disabled MD5 digest : 0x6C 0x40 0x6E 0x9B 0x73 0x77 0xB9 0xD9 As you ca see, there is o VTP domai listed so VTP is curretly disabled. Sytax: Switch# cofigure termial Switch(cofig)# vtp mode {server cliet trasparet} Switch(cofig)# vtp domai domai-id Switch(cofig)# vtp password password Switch(cofig)# vtp versio {1 2} I our example we ll use preplogic as the domai ID ad bcms as the password. The cofiguratio of the three switches is as follows: ple: Switch wg1: wg1#cofigure termial wg1(cofig)#vtp mode cliet wg1(cofig)#vtp domai preplogic wg1(cofig)#vtp password bcms LearSmart Cloud Classroom: Video Traiig Mauals

15 Maual BCMSN Switch wg2: Switch wg3: wg2#cofigure termial wg2(cofig)#vtp mode cliet wg2(cofig)#vtp domai preplogic wg2(cofig)#vtp password bcms wg3#cofigure termial wg3(cofig)#vtp mode server wg3(cofig)#vtp domai preplogic wg3(cofig)#vtp password bcms wg3(cofig)#versio 2 Note that sice the two cliet switches have the VTP domai ad password cofigured, all other VTP cofiguratio chages ca be made o wg3 ad propagated to the cliets. That s why the versio is oly eabled o the server, you ll fid that oce it is etered o the server, the VTP versio 2 is also eabled o the cliet switches. You ca also see that the VTP Revisio umber icremeted because of the chage. Now, the VTP status for our respective switches i the preplogic domai looks like this: wg3#sh vtp status VTP Versio : 2 Cofiguratio Revisio : 5 Maximum VLANs supported locally : 1005 Number of existig VLANs : 7 VTP Operatig Mode : Server VTP Domai Name : preplogic VTP Pruig Mode : Disabled VTP V2 Mode : Eabled VTP Traps Geeratio : Disabled MD5 digest : 0x8F 0x6B 0x23 0x32 0x18 0x0B 0x2D 0x73 wg2#sh vtp status VTP Versio : 2 Cofiguratio Revisio : 5 Maximum VLANs supported locally : 68 Number of existig VLANs : 7 VTP Operatig Mode : Cliet VTP Domai Name : preplogic VTP Pruig Mode : Disabled VTP V2 Mode : Eabled VTP Traps Geeratio : Disabled MD5 digest : 0x8F 0x6B 0x23 0x32 0x18 0x0B 0x2D 0x73 LearSmart Cloud Classroom: Video Traiig Mauals

16 Maual BCMSN wg1#sh vtp status VTP Versio : 2 Cofiguratio Revisio : 5 Maximum VLANs supported locally : 68 Number of existig VLANs : 7 VTP Operatig Mode : Cliet VTP Domai Name : preplogic VTP Pruig Mode : Disabled VTP V2 Mode : Eabled VTP Traps Geeratio : Disabled MD5 digest : 0x8F 0x6B 0x23 0x32 0x18 0x0B 0x2D 0x73 To verify the VTP password iformatio, execute the show vtp password commad: wg3#show vtp password VTP Password: bcms Now we ll go back to our VTP server ad add VLAN 300. wg3#cofigure termial wg3(cofig)#vla 300 Movig over to switch wg2, you ll see that the ew VLAN has bee propagated automatically! wg2#sh vla brief VLAN Name Status Ports default active Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/ VLAN0100 active 200 VLAN0200 active 300 VLAN0300 active 1002 fddi-default active 1003 trcrf-default active 1004 fddiet-default active 1005 trbrf-default active LearSmart Cloud Classroom: Video Traiig Mauals

17 Maual BCMSN VLAN Pruig As stated before, VTP pruig reduces etwork traffic by reducig uecessary flooded traffic, such as broadcast, multicast, ad flooded uicast packets. VTP pruig restricts flooded traffic to those truk liks that have the VLAN cofigured o a port. Usig our previous example, we ll eable VTP pruig ad set the prue eligible VLAN o the truk to switch wg2. We will prue VLAN 200 for the example below. ple: wg3#cofigure termial wg3(cofig)#vtp pruig wg3(cofig)#iterface fa0/2 wg3(cofig-if )#switchport truk pruig vla 200 If switch wg2 does ot have ay switchports cofigured i VLAN 200, the broadcast traffic will ot be set across the truk ad ito the switch. Spaig Tree Protocol (STP) Spaig Tree Protocols i a Hierarchical Network Spaig tree protocol (STP) is a IEEE stadard based o the 802.1D algorithm. The purpose of STP is to prevet layer 2 loops o a etwork. It uses bridge protocol data uits (BPDU) to talk to other switches to remove loops by puttig them ito a blockig state. The exchages of BPDUs also ca tur blocked ports back ito speakig ports whe a lik failure is detected. This allows egieers to cofigure redudat coectios betwee switches while guarateeig that a loop will ot be formed. Every port o a switch has a uique idetifier which is its MAC address. Whe two switches are coected, the STP algorithm assigs a default path cost to the lik based o the type ad speed of the lik. This path cost ca be maipulated as eeded. The spaig tree algorithm (STA) is recalculated each time a etwork topology chage occurs such as a addig or removal of a ew lik or truk, or router, or switch. This is determied whe a switch port begis or stops receivig BPDUs. BPDUs cotai a wealth of iformatio that assist the switch i figurig which path to forward o ad which path to block. The default STP iformatio that is cotaied i the BPDU is as follows: Settig: Default: Switch Priority Port Cost 1000 Mbps: Mbps: Mbps: 100 Port Priority 128 Hello iterval Forward delay Max age 2 secods 15 secods 20 secods LearSmart Cloud Classroom: Video Traiig Mauals

18 Maual BCMSN The switch priority plays a determiig role i which switch becomes the root bridge. The switch with the lowest priority becomes the root. The other factor that determies the root bridge is the port MAC address. The lower MAC address becomes the root if the switch priority is the same o two or more switches. The path costs ad port priority help to compute which liks are placed ito forwardig or blockig state. The hello timer is the time betwee BPDUs beig set. The forward delay timer determies the amout of time the listeig ad learig states last prior to beig moved to a forwardig state. The max age timer determies the amout of time the switch stores STP iformatio received o a port. There are several types of STP that ca be cofigured o Cisco devices. Commo Spaig Tree (CST): This STP protocol provides a sigle istace for the etire layer 2 etwork. All VLANs withi the switched etwork share the same istace. Per VLAN Spaig Tree (PVST): This protocol maitais a separate STP istace for every VLAN cofigured o the switched etwork. Oe of the advatages of PVST is that it ca load balace ad separate traffic across truk liks because oe istace ca block a port o a truk iside a particular VLAN while the other istace will forward their traffic out the same truk. Multiple Istace Spaig Tree (MISTP): This is a IEEE 802.1S protocol that allows egieers to map multiple VLANs ito a istace of STP. Rapid Spaig Tree (RSTP): RSTP is a IEEE 802.1w stadard that is the evolutio of STP over time. The protocol implemets may ew features to allow for faster covergece after a topology chage has occurred. The features are the equivalet to PortFast, BackboeFast ad Uplik- Fast which ca be cofigured with regular STP but are Cisco proprietary. RSTP ca coverge i less tha a secod compared to up to 50 secods with stadard STP. Per VLAN Rapid Spaig Tree (PVRST): A combiatio of PVST+ ad Rapid spaig tree that allows for use of the rapid spaig tree features o a per VLAN basis. For the BCMSN exam, you will eed to kow how to cofigure PVRST ad MISTP. Cofigurig PVRST Figure 5 will be used for our STP cofiguratio examples. Swtches MLS-1 ad MLS-2 are the distributio layer switches. VLANs 100, 200, 300 ad 400 are already pre-cofigured o the MLS switches q truk liks will be cofigured betwee the MLS switches ad the wg1 switch at the access layer. We wat to take advatage of both liks to wg1 so we ll load balace the VLANs by makig MLS-1 the root bridge for VLAN 100 ad 200 ad MLS-2 will be the bridge for VLAN 300 ad 400. That meas that o wg1, all VLAN 100 ad 200 traffic will go i ad out of port fa0/1 ad VLAN 300/400 traffic o port fa0/2. Sytax: Switch# cofigure termial Switch(cofig)#spaig-tree mode {pvst rapid-pvst} mst} Switch(cofig-if )# spaig-tree vla vla-id priority priority LearSmart Cloud Classroom: Video Traiig Mauals

19 Maual BCMSN MLS-1 MLS-2 Fa0/2 Fa0/2 Fa0/1 Fa0/1 Fa0/1 Fa0/2 wg1 Figure 5 ple: MLS-1#cofigure termial MLS-1(cofig)#spaig-tree mode rapid-pvst MLS-1(cofig)#spaig-tree backboefast MLS-1(cofig)#spaig-tree vla 100,200 priority 8192 MLS-1(cofig)#spaig-tree vla 300,400 priority MLS-1(cofig)#iterface FastEtheret0/1 MLS-1(cofig-if )# switchport truk ecapsulatio dot1q MLS-1(cofig-if )# switchport mode truk MLS-1(cofig-if )# switchport truk allowed vla 100,200,300,400 MLS-1(cofig)#iterface FastEtheret0/2 MLS-1(cofig-if )# switchport truk ecapsulatio dot1q MLS-1(cofig-if )# switchport mode truk MLS-1(cofig-if )# switchport truk allowed vla 100,200,300,400 MLS-2#cofigure termial MLS-2(cofig)#spaig-tree mode rapid-pvst MLS-2(cofig)#spaig-tree backboefast MLS-2(cofig)#spaig-tree vla 300,400 priority 8192 MLS-2(cofig)#spaig-tree vla 100,200 priority MLS-2cofig)#iterface FastEtheret0/1 MLS-2(cofig-if )# switchport truk ecapsulatio dot1q MLS-2(cofig-if )# switchport mode truk MLS-2(cofig-if )# switchport truk allowed vla 100,200,300,400 MLS-2cofig)#iterface FastEtheret0/2 MLS-2(cofig-if )# switchport truk ecapsulatio dot1q MLS-2(cofig-if )# switchport mode truk MLS-2(cofig-if )# switchport truk allowed vla 100,200,300,400 LearSmart Cloud Classroom: Video Traiig Mauals

20 Maual BCMSN wg1#cofigure termial wg1(cofig)#spaig-tree mode rapid-pvst wg1(cofig)#spaig-tree portfast bpduguard default wg1(cofig)#iterface FastEtheret0/1 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#switchport truk allowed vla 100,200,300,400 wg1(cofig)#iterface FastEtheret0/2 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#switchport truk allowed vla 100,200,300,400 Now if we do a show spaig-tree active commad o switch wg1 we see that there is ideed a separate istace of RSTP o each VLAN. VLANs 100 ad 200 are forwardig traffic out Fa0/1 ad blockig o Fa0/2. VLANs 300 ad 400 are blockig o Fa0/1 ad forwardig o Fa0/2: wg1#show spaig-tree active VLAN0100 Spaig tree eabled protocol rstp Root ID Priority 8192 Address 000e.392c.68bc Cost 19 Port 1 (FastEtheret0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority Address 000e.39d9.40a4 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Agig Time 300 Iterface Role Sts Cost Prio.Nbr Type Fa0/1 Root FWD P2p Fa0/2 Alt BLK P2p VLAN0200 Spaig tree eabled protocol rstp Root ID Priority 8192 Address 000e.392c.48c4 Cost 19 Port 1 (FastEtheret0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority Address 000e.39d9.40a4 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Agig Time 300 Iterface Role Sts Cost Prio.Nbr Type Fa0/1 Root FWD P2p Fa0/2 Alt BLK P2p LearSmart Cloud Classroom: Video Traiig Mauals

21 Maual BCMSN VLAN0300 Spaig tree eabled protocol rstp Root ID Priority 8192 Address 000e.392c.43b4 Cost 19 Port 1 (FastEtheret0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority Address 000e.39d9.30a1 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Agig Time 300 Iterface Role Sts Cost Prio.Nbr Type Fa0/1 Root FWD P2p Fa0/2 Alt BLK P2p VLAN0400 Spaig tree eabled protocol rstp Root ID Priority 8192 Address 000e.392c.18b6 Cost 19 Port 1 (FastEtheret0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority Address 000e.39d9.20c9 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Agig Time 300 Iterface Role Sts Cost Prio.Nbr Type Fa0/1 Alt BLK P2p Fa0/2 Root FWD P2p Next, we ll move to the MLS-1 switch ad look at the VLAN 100 RSTP istace to verify the proper STP setup. Here, we ca see that the Root ID MAC address ad it s ow Bridge ID MAC address are the same. It also states that this bridge is the root for VLAN 100. Also ote that both Fa0/1 ad Fa0/2 have a role of Desg ad a status of forwardig (FWD). LearSmart Cloud Classroom: Video Traiig Mauals

22 Maual BCMSN MLS-1#show spaig-tree active VLAN0100 Spaig tree eabled protocol rstp Root ID Priority 8192 Address 000e.392c.68bc This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 8192 Address 000e.392c.68bc Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Agig Time 300 Iterface Role Sts Cost Prio.Nbr Type Fa0/1 Desg FWD P2p Fa0/2 Desg FWD P2p Now we ca compare what switch MLS-2 looks like for VLAN 100. The bridge priority of VLAN 100 for this switch is Sice MLS-1 has a lower priority, it is the root switch. The Root ID address is MAC address of the Bridge Address o switch MLS-1. Fially, iterface Fa0/1 is Desg ad forwardig (FWD) ad Fa0/2 is Root ad FWD. MLS-2#show spaig-tree active VLAN0100 Spaig tree eabled protocol rstp Root ID Priority 8192 Address 000e.392c.68bc Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority Address 000e.392c.6863 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Agig Time 300 Iterface Role Sts Cost Prio.Nbr Type Fa0/1 Desg FWD P2p Fa0/2 Root FWD P2p LearSmart Cloud Classroom: Video Traiig Mauals

23 Maual BCMSN Cofigurig MISTP The goal of MISTP is to group multiple VLANs ito a istace of rapid-spaig tree. Groupig multiple VLANs ito oe rapid-spaig tree istace ca reduce CPU ad badwidth resources by reducig BPDU traffic. All VLANs are first placed ito a sigle istace which is IST0 (iteral spaig tree). You ca the create ew istaces from 1 to These maual istaces are called MST s. Keep i mid however that Cisco switches ca oly support a maximum of 16 to 65 istaces depedig o the hardware. IST is the oly istace that ca sed ad receive BPDUs i the MST etwork. ISTs i differet regios are itercoected through commo spaig tree (CST). Also keep i mid that MISTP is fully backward compatible with PVST ad 802.1D STP. Sytax: Switch# cofigure termial Switch(cofig)#spaig-tree mode {pvst rapid-pvst} mst} Switch(cofig-if )#spaig-tree mst cofiguratio Switch(cofig-mst)#ame istace-ame Switch(cofig-mst)#revisio revisio-umber Switch(cofig-mst)#istace istace-umber vla vla-id Switch(cofig-mst)#exit MLS-1(cofig)# spaig-tree mst istace-umber root {primary secodary} MLS-1 MLS-2 Fa0/2 Fa0/2 Fa0/1 Fa0/1 Fa0/1 Fa0/2 wg1 Figure 6 Figure 6 is the example we will be usig to cofigure MISTP. Istace 1 will cotai VLANs 100, 200 ad 300. Istace 2 cotais 10, 20 ad 30. IST 0 ad MST 1 will be cofigured to use MLS-1 as the root. MST 2 will use MLS-2 for it s root switch. This effectively load balaces the traffic across both truk liks o access switch wg1. LearSmart Cloud Classroom: Video Traiig Mauals

24 Maual BCMSN ple: MLS-1(cofig)# spaig-tree mode mst MLS-1(cofig)# spaig-tree mst cofiguratio MLS-1(cofig-mst)# ame preplogic1 MLS-1(cofig-mst)# revisio 10 MLS-1(cofig-mst)# istace 1 vla 100, 200, 300 MLS-1(cofig-mst)# istace 2 vla 10, 20, 30 MLS-1(cofig-mst)# exit MLS-1(cofig)# spaig-tree mst 0-1 root primary MLS-1(cofig)# spaig-tree mst 2 root secodary MLS-2(cofig)# spaig-tree mode mst MLS-2(cofig)# spaig-tree mst cofiguratio MLS-2(cofig-mst)# ame preplogic1 MLS-2(cofig-mst)# revisio 10 MLS-2(cofig-mst)# istace 1 vla 100, 200, 300 MLS-2(cofig-mst)# istace 2 vla 10, 20, 30 MLS-2(cofig-mst)# exit MLS-2(cofig)# spaig-tree mst 2 root primary MLS-2(cofig)# spaig-tree mst 0-1 root secodary STP Mechaisms A Cisco switch has several methods that ca be implemeted to isure faster covergece ad so a spaig tree loop does ot accidetally occur. These mechaisms iclude: PortFast UplikFast BackboeFast BPDU guard BPDU filterig L Loop guard Root guard Uidirectioal lik detectio (UDLD) LearSmart Cloud Classroom: Video Traiig Mauals

25 Maual BCMSN PortFast Whe a switchport coects to a sigle ed device such as a PC or server, spaig-tree PortFast ca be cofigured to allow the port to bypass the listeig ad learig phases of STP ad begi forwardig immediately. PortFast is a iterface commad o the switch. Sytax: Switch#cofigure termial Switch (cofig)#iterface iterface-id Switch(cofig-if )#spaig-tree portfast [truk] show spaig-tree iterface iterface-id Note that you ca add PortFast to a truk port with the truk commad. You eed to isure that there are o physical loops prior to removig PortFast o a truk lik. BPDU Guard PortFast is a good thig but the problem occurs whe a switch gets plugged ito oe of these ports does ot check for other forwardig ports. If this happes, a loop ca occur. BPDU Guard fixes this problem by moitorig the port for ay sigs of BPDU s o the switchport. This commad ca be cofigured o ay o-trukig access port. These ports should ever see BPDU iformatio o them. If the switch does see a BPDU set across a switchport, that particular port is put ito errdisable mode ad becomes ioperable util it is brought back up by performig a o shutdow o the iterface. BPDU Guard is a global cofiguratio commad. Sytax: Switch# cofigure termial Switch(cofig)#spaig-tree portfast bpduguard You ca also cofigure BPDU guard o a per-iterface basis. Sytax: Switch#cofigure termial Switch(cofig)#iterface iterface-id Switch(cofig-if )#spaig-tree bpduguard eable BPDU Filterig Whe ports are cofigured for spaig tree Port Fast, they sed out a few BPDU s whe the port becomes active. Eablig BPDU filterig at a global level stops all BPDU s from beig set. If a BPDU is detected o a Port Fast eabled port with BPDU filterig, it chages to a stadard o-port Fast port. Sytax: Switch#cofigure termial Switch(cofig)#spaig-tree portfast bpdufilter default Switch(cofig)#iterface iterface-id Switch(cofig-if )#spaig-tree portfast LearSmart Cloud Classroom: Video Traiig Mauals

26 Maual BCMSN UDLD Uidirectioal lik detectio (UDLD) is a protocol that moitors ad detects physical problems with fiber optic or copper cablig. Physical failures ca cause a up state i a sigle directio. This ca lead to spaig-tree loops. Whe the UDLD protocol detects a problem, it shuts dow the port admiistratively ad seds a log message. UDLD oly works whe both ed of the liks are capable of ruig the protocol. The protocol seds ad receives hello messages that commuicate the health of the physical lik. The message timers ca be modified to sed hello s from 1 to 90 secods. The two modes of UDLD are ormal ad aggressive. UDLD ormal: Detects uidirectioal problems o fiber optic cablig due to miscoected fiber. UDLD aggressive: Detects oe-way traffic o fiber ad copper liks i additio to miscoected fiber liks. For example, if a fiber or copper poit-to-poit coectio is able to sed traffic but ot receive it. Aother example is if oe side of the lik is up while the opposite side is dow. Sytax: UDLD ca be cofigured at a global or iterface level. The global cofiguratio oly affects fiber ports. Copper ports must be cofigured at a iterface level to eable UDLD aggressive mode. Global Cofiguratio: Switch#cofigure termial Switch(cofig)#udld {aggressive eable message time message-timer-iterval} Iterface Cofiguratio: Switch#cofigure termial Switch(cofig)#iterface iterface-id Switch(cofig-if )#udld port [aggressive] To verify the cofiguratio of UDLD use the show udld for global cofiguratios ad show udld iterface-id to verify UDLD cofigured at a iterface level. If a iterface has bee shut dow to a UDLD violatio, the udld reset commad clears resets the iterface so it ca begi fuctioig properly agai. Loop Guard Loop guard is used to prevet o-desigated ports from becomig desigated ports because of a UDLD lik detectio. Loop guard oly works with P2P liks ad operates oly whe PVST+, RPVST+ ad MSTP are cofigured as the spaig-tree protocol. Sytax: Switch#cofigure termial Switch(cofig)#spaig-tree loopguard default LearSmart Cloud Classroom: Video Traiig Mauals

27 Maual BCMSN Root Guard Root guard prevets a switch from becomig the root bridge. Root guard is performed o a per-port basis ad isures that the root guard cofigured port maitais a desigated state. Sytax: Switch#cofigure termial Switch(cofig)#iterface iterface-id Switch(cofig-if )#spaig-tree guard root Lik Aggregatio (EtherChael) EtherChael provides a way to aggregate multiple Etheret coectios ito oe logical lik. It s a simple way to icrease badwidth betwee your switches where you fid bottleecks. Oce a group of liks are boded with EtherChael, it has the ability to recover whe a lik failure occurs withi the aggregate chael. Up to 8 fast Etheret or gigabit Etheret liks ca be chaeled to provide for up to 800 ad 8000 Mbps full duplex badwidth respectively. All the liks i the EtherChael must be of the same speed ad they eed to be cofigured as layer 2 or layer 3 iterfaces. EtherChael is cofigured i oe of three ways o a Cisco switch. EtherChael O mode statically sets up the liks ito a chael. Lik Aggregatio Cotrol Protocol (LACP) ad Port Aggregatio Cotrol Protocol (PAgP) egotiates chaelized ports with the other side. No matter which method you choose, both sides of the chael lik must be cofigured the same. Load balacig o EtherChaels happes at the MAC address level. By default, source-address load balacig is cofigured. What this meas is that whe a frame eters a EtherChael, it gets radomly assiged a lik to use based o the source MAC address. This works great if you have multiple hosts attached to a switch that is cofigured for EtherChael. Each PC or ed device has a uique MAC address ad load-balacig will occur across the liks. Whe traffic has to go through a layer 3 device that coects to a Ether- Chael lik, source based MAC address balacig does ot work because all traffic will come from the MAC address assiged to the layer 3 iterface. I this case, it is better to use destiatio-based Load balacig which radomly assigs frames to ports withi the EtherChael based o the destiatio MAC address. Layer 2 EtherChael Sytax: Switch#cofigure termial Switch(cofig)#iterface iterface-id Switch(cofig-if )#switchport mode {access truk} chael-group chael-group-umber mode {{auto [o-silet] desirable [o-silet] o} {active passive}} LearSmart Cloud Classroom: Video Traiig Mauals

28 Maual BCMSN Layer 3 EtherChael Switch#cofigure termial Switch(cofig)#iterface port-chael port-chael-umber Switch(cofig-if )#o switchport Switch(cofig-if )#ip address ip-address mask Switch(cofig-if )#iterface iterface-id Switch(cofig-if )#o switchport Switch(cofig-if )#o ip address Switch(cofig-if )#chael-group chael-group-umber mode {auto [o-silet] desirable [o-silet] o active passive} EtherChael Load Balacig Switch#cofigure termial Switch(cofig)#port-chael load-balace {src-mac dst-mac} EtherChael o Cofiguratio EtherChael O mode does ot egotiate chaelig. It forces a port to joi a EtherChael ad is useful whe oe side of a switch does ot support either PAgP or LACP. If a port is cofigured that is ot compatible (i.e. cofigurig 2 GigE ports ad oe FE port) that port will be placed ito a suspeded state. Our example will cofigure a layer 2 EtherChael mode o betwee wg1 ad wg2. The EtherChael will be a 802.1q truk that trasports VLANs 100 ad 200. Use Figure 7 as the physical setup. Fa0/1 Fa0/2 Fa0/1 Fa0/2 wg1 Fa0/3 Fa0/4 Fa0/3 Fa0/4 wg2 Figure 7 LearSmart Cloud Classroom: Video Traiig Mauals

29 Maual BCMSN ple: Switch wg1: Switch wg2: wg1#cofigure termial wg1(cofig)#iterface fa0/1 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode o wg1(cofig)#iterface fa0/2 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode o wg1(cofig)#iterface fa0/3 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode o wg1(cofig)#iterface fa0/4 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode o wg2#cofigure termial wg2(cofig)#iterface fa0/1 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode o wg2(cofig)#iterface fa0/2 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode o wg2(cofig)#iterface fa0/3 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode o wg2(cofig)#iterface fa0/4 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode o LearSmart Cloud Classroom: Video Traiig Mauals

30 Maual BCMSN You ca check the status of your EtherChael by usig the followig commads: wg2#show etherchael summary Flags: D - dow P - i port-chael I - stad-aloe s - suspeded H - Hot-stadby (LACP oly) R - Layer3 S - Layer2 u - usuitable for budlig U - i use f - failed to allocate aggregator d - default port Number of chael-groups i use: 1 Number of aggregators: 1 Group Port-chael Protocol Ports Po1(SU) - Fa0/1(P) Fa0/2(P) Fa0/3(P) Fa0/4(P) wg2#show etherchael protocol Chael-group listig: Group: Protocol: - (Mode ON) wg2#show etherchael load-balace Source MAC address PAgP Cofiguratio PAgP is a Cisco proprietary protocol that facilitates the creatio of EtherChaels automatically. There are two ways to setup the exchage of PAgP egotiatio messages betwee two Cisco devices: Desirable: Actively seds out PAgP egotiatio messages to establish the EtherChael. Auto: A passive listeig state where the iterface will respod to PAgP messages but will ot iitiate commuicatio. It helps to reduce egotiatio messages. Note: If both sides of the chael are cofigured for auto, the chael will ever establish. I our example, we will cofigure a Layer 2 PAgP EtherChael to chaelize 4 Fe 802.1q truk ports. Oe side of the PAgP setup will be cofigured as desirable ad the other will be setup as auto. We also wat to cofigure destiatio-based load balacig. Figure 8 is the diagram for the physical setup i this example. Fa0/1 Fa0/2 Fa0/1 Fa0/2 wg1 Fa0/3 Fa0/4 Fa0/3 Fa0/4 wg2 Figure 8 LearSmart Cloud Classroom: Video Traiig Mauals

31 Maual BCMSN ple: Switch wg1: Switch wg2: wg1#cofigure termial wg1(cofig)#iterface fa0/1 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode desirable wg1(cofig)#iterface fa0/2 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode desirable wg1(cofig)#iterface fa0/3 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode desirable wg1(cofig)#iterface fa0/4 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#chael-group 1 mode desirable wg1(cofig-if )#exit wg1(cofig)#port-chael load-balace dst-mac wg2#cofigure termial wg2(cofig)#iterface fa0/1 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode auto wg2(cofig)#iterface fa0/2 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode auto wg2(cofig)#iterface fa0/3 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode auto wg2(cofig)#iterface fa0/4 wg2(cofig-if )#switchport truk ecapsulatio dot1q wg2(cofig-if )#switchport mode truk wg2(cofig-if )#chael-group 1 mode auto wg2(cofig-if )#exit wg2(cofig)#port-chael load-balace dst-mac LearSmart Cloud Classroom: Video Traiig Mauals

32 Maual BCMSN Let s verify our PAgP cofiguratio usig some show commads: wg2#show etherchael summary Flags: D - dow P - i port-chael I - stad-aloe s - suspeded H - Hot-stadby (LACP oly) R - Layer3 S - Layer2 u - usuitable for budlig U - i use f - failed to allocate aggregator d - default port Number of chael-groups i use: 1 Number of aggregators: 1 Group Port-chael Protocol Ports Po1(SU) PAgP Fa0/1(P) Fa0/2(P) Fa0/3(P) Fa0/4(P) wg2#show etherchael protocol Chael-group listig: Group: Protocol: PAgP wg2#show etherchael load-balace Destiatio MAC address LACP Cofiguratio LACP is a IEEE 802.1ad stadard protocol. It works virtually the same way as PAgP. There are two ways to setup LACP commuicatios betwee iterfaces: Active: Actively egotiates with other iterfaces by sedig LACP messages. Passive: Places the iterface ito listeig mode that waits to hear LACP messages from Active ports. Note: If both sides of the chael are cofigured for passive, the chael will ever establish. For our LACP cofiguratio, we ll cofigure a Layer 3 LACP EtherChael betwee 2 routers usig 4 FE coectios. Figure 9 will be the physical setup for the example. Fa0/1 Fa0/2 Fa0/1 Fa0/2 rtr1 Fa0/3 Fa0/4 Fa0/3 Fa0/4 rtr2 Figure 9 LearSmart Cloud Classroom: Video Traiig Mauals

33 Maual BCMSN ple: Router rtr1: rtr1#cofiguratio termial rtr1(cofig)#it port-chael 1 rtr1(cofig-if )#ip add rtr1(cofig-if )#it fa0/1 rtr1(cofig-if )#o ip address rtr1(cofig-if )#chael-group 1 mode active rtr1(cofig-if )#it fa0/2 rtr1(cofig-if )#o ip address rtr1(cofig-if )#chael-group 1 mode active rtr1(cofig-if )#it fa0/3 rtr1(cofig-if )#o ip address rtr1(cofig-if )#chael-group 1 mode active rtr1(cofig-if )#it fa0/4 rtr1(cofig-if )#o ip address rtr1(cofig-if )#chael-group 1 mode active Router rtr2: rtr2#cofiguratio termial rtr2(cofig)#it port-chael 1 rtr2(cofig-if )#o switchport rtr2(cofig-if )#ip add rtr2(cofig-if )#it fa0/1 rtr2(cofig-if )#o ip address rtr2(cofig-if )#chael-group 1 mode passive rtr2(cofig-if )#it fa0/2 rtr2(cofig-if )#o ip address rtr2(cofig-if )#chael-group 1 mode passive rtr2(cofig-if )#it fa0/3 rtr2(cofig-if )#o ip address rtr2(cofig-if )#chael-group 1 mode passive rtr2(cofig-if )#it fa0/4 rtr2(cofig-if )#o ip address rtr2(cofig-if )#chael-group 1 mode passive LearSmart Cloud Classroom: Video Traiig Mauals

34 Maual BCMSN Let s verify our LACP cofiguratio usig some show commads: rtr2#show etherchael summary Flags: D - dow P - i port-chael I - stad-aloe s - suspeded H - Hot-stadby (LACP oly) R - Layer3 S - Layer2 u - usuitable for budlig U - i use f - failed to allocate aggregator d - default port Number of chael-groups i use: 1 Number of aggregators: 1 Group Port-chael Protocol Ports Po1(RU) LACP Fa0/1(P) Fa0/2(P) Fa0/3(P) Fa0/4(P) rtr2#show etherchael protocol Chael-group listig: Group: Protocol: LACP rtr2#show etherchael load-balace Source MAC address Iter-VLAN Routig Explaatio of Iter-VLAN Routig As we have leared, VLANs are logical broadcast segmetatios of a etwork. I order to sed traffic from a device o VLAN A to a device o VLAN B, the traffic must go through a layer 3 routed iterface. Iter- VLAN routig provides the mechaism to eable routig of traffic betwee VLANs. Cofigurig Iter-VLAN Routig There are basically two ways to cofigure Iter-VLAN routig. The first method is to cofigure a router o a stick. This method uses a stadard layer 2 switch that is cofigured for multiple VLANs. Each VLAN has either a separate or truk port to a router that has the VLAN default gateway IP address(es) cofigured o it. Whe a device o a VLAN eeds to commuicate to a device o aother VLAN, that traffic is set up to the router o oe VLAN ad returs to the switch o the other VLAN. Figure 10 is a example Iter-VLAN routig usig the router o a stick method. LearSmart Cloud Classroom: Video Traiig Mauals

35 Maual BCMSN Router Sytax: Switch Sytax: Router#cofigure termial Router(cofig)#iterface iterface-id Router(cofig-if )#o shutdow Router(cofig-if )#iterface iterface-id.sub-it-id rtr1(cofig-subif )#ecapsulatio {dot1q isl } vla-id Router(cofig-subif )#ip address ip-address subet-mask Router(cofig-subif )#ed Switch#cofigure termial Switch(cofig)#iterface vla vla-id Switch(cofig-if )#o shutdow Switch(cofig)# iterface iterface-id Switch(cofig-if )# switchport truk ecapsulatio {isl dot1q egotiate} Switch(cofig-if )# switchport mode {dyamic {auto desirable} truk} VLAN 100 VLAN 200 Fa0/1 Fa0/0 wg1 rtr2 Figure 10 I this example, we will cofigure a 802.1q tru betwee wg2 ad rtr1. Use sub-iterface fa0/0.1 for VLAN 100 ad fa0/0.2 for vla 200. LearSmart Cloud Classroom: Video Traiig Mauals

36 Maual BCMSN ple: Router Cofiguratio: rtr1#cofigure termial rtr1(cofig)#iterface FastEtheret0/0 rtr1(cofig-if )#o shutdow rtr1(cofig-if )#iterface FastEtheret0/0.1 rtr1(cofig-subif )#ecapsulatio dot1q 100 rtr1(cofig-subif )#ip address rtr1(cofig-subif )#iterface FastEtheret0/0.2 rtr1(cofig-subif )#ecapsulatio dot1q 200 rtr1(cofig-subif )#ip address Switch Cofiguratio: wg1#cofigure termial wg1(cofig)#iterface vla 100 wg1(cofig-if )#o shutdow wg1(cofig-if )#iterface vla 200 wg1(cofig-if )#o shutdow wg1(cofig-if )#it fa0/20 wg1(cofig-if )#switchport access vla 100 wg1(cofig-if )#spaig-tree portfast wg1(cofig-if )#it fa0/21 wg1(cofig-if )#switchport access vla 200 wg1(cofig-if )#spaig-tree portfast wg1(cofig-if )#it fa0/1 wg1(cofig-if )#switchport truk ecapsulatio dot1q wg1(cofig-if )#switchport mode truk wg1(cofig-if )#ed To verify iter-vlan routig, do the fowllowig router ad switch commads: rtr1#show ip route Codes: C - coected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP exteral, O - OSPF, IA - OSPF iter area N1 - OSPF NSSA exteral type 1, N2 - OSPF NSSA exteral type 2 E1 - OSPF exteral type 1, E2 - OSPF exteral type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS iter area * - cadidate default, U - per-user static route, o - ODR P - periodic dowloaded static route Gateway of last resort is ot set C /24 is directly coected, FastEtheret0/0.2 C /24 is directly coected, FastEtheret0/0.1 LearSmart Cloud Classroom: Video Traiig Mauals

37 Maual BCMSN wg1#sh vla brief VLAN Name Status Ports default active Fa0/2, Fa0/3, Fa0/4, Fa0/5 Fa0/6, Fa0/7, Fa0/8, Fa0/9 Fa0/10, Fa0/11, Fa0/12, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/18, Fa0/19, Fa0/22, Fa0/23 Fa0/24, Fa0/25, Fa0/26, Fa0/27 Fa0/28, Fa0/29, Fa0/30, Fa0/31 Fa0/32, Fa0/33, Fa0/34, Fa0/35 Fa0/36, Fa0/37, Fa0/38, Fa0/39 Fa0/40, Fa0/41, Fa0/42, Fa0/43 Fa0/44, Fa0/45, Fa0/46, Fa0/47 Fa0/48, Gi0/1, Gi0/2 100 VLAN0100 active Fa0/ VLAN0200 active Fa0/21 wg1#show iterfaces truk Port Mode Ecapsulatio Status Native vla Fa0/1 o 802.1q trukig 1 Port Vlas allowed o truk Fa0/ Port Vlas allowed ad active i maagemet domai Fa0/1 1,100,200,300 Port Vlas i spaig tree forwardig state ad ot prued Fa0/1 1,100,200 The other method to cofigure Iter-VLAN routig is to use a multi-layer switch (MLS) to cofigure switch virtual iterfaces (SVI). SVIs are virtual layer 3 iterfaces that have the ability to route betwee VLANs. Thik of a MLS with SVIs as a combiatio of a switch ad a router. Now, you oly eed oe switch to perform iter-vlan routig as show i Figure 11. Sytax: Switch#cofigure termial Switch(cofig)#ip routig Switch(cofig)#iterface vla vla-id Switch(cofig-if )#ip address ip-address subet-mask Switch(cofig-if )#o shutdow Switch(cofig)# iterface iterface-id Switch (cofig-if )#iterface iterface-id Switch(cofig-if )#switchport access vla vla-id Switch(cofig-if )#ed LearSmart Cloud Classroom: Video Traiig Mauals

38 Maual BCMSN VLAN 100 VLAN 200 Figure 11 I this example, we will cofigure VLAN 100 ad VLAN 200 o MLS-1 to route betwee each other. Assume PC100 is o Fa0/20 ad PC200 is o Fa0/21. Note: The VLAN iterfaces will ot go ito the up/up state util a device o that VLAN is liked. ple: MLS-1(cofig)#ip routig MLS-1(cofig)#it vla 100 MLS-1(cofig-if )#ip add MLS-1(cofig-if )#o shut MLS-1(cofig-if )#it vla 200 MLS-1(cofig-if )#ip add MLS-1(cofig-if )#o shut MLS-1(cofig-if )#iterface fa0/20 MLS-1(cofig-if )#switchport access vla 100 MLS-1(cofig-if )#spaig-tree portfast MLS-1(cofig-if )#iterface fa0/21 MLS-1(cofig-if )#switchport access vla 200 MLS-1(cofig-if )#spaig-tree portfast MLS-1(cofig-if )#ed To verify iter-vlan routig, use the followig commads: MLS-1#show ip route Codes: C - coected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP exteral, O - OSPF, IA - OSPF iter area N1 - OSPF NSSA exteral type 1, N2 - OSPF NSSA exteral type 2 E1 - OSPF exteral type 1, E2 - OSPF exteral type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS iter area * - cadidate default, U - per-user static route, o - ODR P - periodic dowloaded static route Gateway of last resort is ot set C /24 is directly coected, Vla200 C /24 is directly coected, Vla100 LearSmart Cloud Classroom: Video Traiig Mauals

39 Maual BCMSN MLS-1#show ip iterface brief Iterface IP-Address OK? Method Status Protocol Vla1 uassiged YES uset admiistratively dow dow Vla YES maual up up Vla YES maual up up FastEtheret0/1 uassiged YES uset up dow FastEtheret0/2 uassiged YES uset up dow FastEtheret0/3 uassiged YES uset up dow FastEtheret0/4 uassiged YES uset up dow FastEtheret0/5 uassiged YES uset dow dow FastEtheret0/6 uassiged YES uset dow dow FastEtheret0/7 uassiged YES uset dow dow FastEtheret0/8 uassiged YES uset dow dow FastEtheret0/9 uassiged YES uset dow dow FastEtheret0/10 uassiged YES uset dow dow FastEtheret0/11 uassiged YES uset dow dow FastEtheret0/12 uassiged YES uset dow dow FastEtheret0/13 uassiged YES uset dow dow FastEtheret0/14 uassiged YES uset dow dow FastEtheret0/15 uassiged YES uset dow dow FastEtheret0/16 uassiged YES uset dow dow FastEtheret0/17 uassiged YES uset dow dow FastEtheret0/18 uassiged YES uset dow dow FastEtheret0/19 uassiged YES uset dow dow FastEtheret0/20 uassiged YES uset up up FastEtheret0/21 uassiged YES uset up up FastEtheret0/22 uassiged YES uset dow dow FastEtheret0/23 uassiged YES uset dow dow FastEtheret0/24 uassiged YES uset dow dow Explai ad Eable CEF Cisco Express Forwardig (CEF) is a layer 3 switchig techology that improves switchig performace o CEF capable MLS switches. As we kow, routig is slower tha switchig due to the fact that each packet i a router has to do a routig lookup prior to puttig it o the wire. CEF attempts to achieve wire speeds by buildig a forwardig iformatio base (FIB) that pre-populates destiatio routig iformatio. Now, packets look to the FIB that already kows what route a particular packet is goig to take. This speeds up the layer 3 routig process ad lesses the load o the MLS CPU. CEF is eabled by default o all Cisco layer 3 switches. The oly reaso that it should ever be tured off is for troubleshootig usig the debug ip packet detail commad. I order to see all forwarded packets i the debug, you must tur off CEF so every packet will be processed by the CPU. To tur off CEF o a iterface, use the followig sytax: Sytax: Switch#cofigure termial Switch(cofig)# iterface iterface-id Switch(cofig-if )#o ip route-cache cef LearSmart Cloud Classroom: Video Traiig Mauals

40 Maual BCMSN You ca verify CEF status ad adjacecies by usig the followig commads: show ip cef show adjacecy Gateway Redudacy Techologies Gateway redudacy is also kow as first hop redudacy due to the fact that it provides ed-device redudacy from a default gateway stadpoit. The three mai redudacy protocols that Cisco layer 3 devices utilize are Hot Stadby Routig Protocol (HSRP), Virtual Router Redudacy Protocol (VRRP) ad the Gateway Load Balacig Protocol (GLBP). HSRP HSRP is a Cisco proprietary protocol that performs automatic router backup whe you cofigure it o Cisco capable devices. There are three iterface types that ca be cofigured for HSRP: 1. Stadard Routed Ports 2. MLS switched virtual iterfaces (SVI) 3. Layer 3 EtherChaels HSRP takes 2 redudat layer 3 gateways ad groups them together. Oce they are iside a HSRP group, they are cofigured to share a Virtual MAC ad IP address. That virtual IP address is what the ed statios use as the gateway address. Oe of the HSRP iterfaces is the active ad the other is the stadby iterface. If for some reaso, the active fails, the stadby iterface detects the failure ad takes over the gateway duties. HSRP uses a priority cofiguratio to determie which layer 3 iterface is primary. Whe HSRP is iitially cofigured, the device has a default priority of 100. The highest priority becomes the active iterface. HSRP commuicates to its peers by sedig multicast messages. These messages iclude: Hello: Verifies that the routers are still fuctioig properly. Coup: Whe a stadby router becomes the active router. Resig: Whe a router that is the active router seds this message whe it is about to give up beig the active due to aother router with a higher priority comig olie. Whe ew HSRP routers come olie, they ca immediately try to become the active router if the stadby preempt commad is used. You wat to use this commad o the router with the highest priority. Sytax: Switch#cofigure termial Switch(cofig)#iterface iterface-id Switch(cofig-if )# stadby group-umber ip virtual-ip-address Switch(cofig-if )#stadby group-umber priority priority [preempt [delay delay]] LearSmart Cloud Classroom: Video Traiig Mauals

41 Maual BCMSN MLS-1 MLS-2 Fa0/2 Fa0/2 Fa0/1 Fa0/1 Fa0/1 Fa0/2 wg1 Fa0/20 IP Add: /24 Gateway: Figure 12 I our HSRP ple, we ll cofigure 2 MLS switches with a SVI o VLAN 100 to ru HSRP betwee the two will be the HSRP virtual iterface. We d like MLS-1 to be the primary HSRP router. Use Figure 12 as the physical layout for this example. ple: Switch MLS-1: Switch MLS-2: MLS-1#cofigure termial MLS-1(cofig)#iterface FastEtheret0/1 MLS-1(cofig-if )#switchport access vla 100 MLS-1(cofig-if )#iterface FastEtheret0/2 MLS-1(cofig-if )#switchport access vla 100 MLS-1(cofig-if )#iterface Vla100 MLS-1(cofig-if )#ip address MLS-1(cofig-if )#stadby 1 ip MLS-1(cofig-if )#stadby 1 priority 110 preempt MLS-2#cofigure termial MLS-2(cofig)#iterface FastEtheret0/1 MLS-2(cofig-if )#switchport access vla 100 MLS-2(cofig-if )#iterface FastEtheret0/2 MLS-2(cofig-if )#switchport access vla 100 MLS-2(cofig-if )#iterface Vla100 MLS-2(cofig-if )#ip address MLS-2(cofig-if )#stadby 1 ip LearSmart Cloud Classroom: Video Traiig Mauals

42 Maual BCMSN Switch wg1: wg1#cofigure termial wg1cofig-if )#iterface fa0/1 wg1 (cofig-if )#switchport access vla 100 wg1 (cofig-if )#iterface fa0/2 wg1 (cofig-if )#switchport access vla 100 Let s verify our HSRP cofiguratio usig the show stadby commad o MLS-1 ad MLS-2. MLS-1#show stadby Vla100 - Group 1 Local state is Active, priority 110, may preempt Hellotime 3 sec, holdtime 10 sec Next hello set i Virtual IP address is cofigured Active router is local Stadby router is expires i Virtual mac address is c07.ac01 1 state chages, last state chage 00:10:02 IP redudacy ame is hsrp-vl100-1 (default) MLS-2#show stadby Vla100 - Group 1 Local state is Stadby, priority 100 Hellotime 3 sec, holdtime 10 sec Next hello set i Virtual IP address is cofigured Active router is , priority 110 expires i Stadby router is local 4 state chages, last state chage 00:10:41 IP redudacy ame is hsrp-vl100-1 (default) VRRP VRRP is a IETF stadard gateway redudacy protocol. Because it s a stadard, it ca be used i multivedor eviromets. VRRP cofiguratio eables a group of layer 3 devices to form a sigle virtual router. The ed devices the use the virtual router as their default gateway address. VRRP works very much like HSRP but istead of creatig a Virtual IP address, VRRP uses the master iterface physical IP address. If for some reaso, the master VRRP router fails, the backup VRRP router takes over the IP address ad applies it to its physical iterface. VRRP uses a priority feature to determie which device is the master ad which oes are the backups. The highest priority is the master. The priority ca be cofigured betwee 1 ad 254. If two routers have the same priority, the router with the highest IP address becomes the master. The default priority is 100. LearSmart Cloud Classroom: Video Traiig Mauals

43 Maual BCMSN Below is the sytax to cofigure basic VRRP: Sytax: Router#cofigure termial Router(cofig)#iterface iterface-id Router(cofig-if )# ip address ip-address mask Router(cofig-if )#vrrp group ip ip-address Router(cofig-if )# vrrp group priority level Router(cofig-if )# vrrp group preempt rtr1 rtr2 Fa0/1 Fa0/1 Fa0/0 Fa0/0 Fa0/1 Fa0/2 wg1 Fa0/20 IP Add: /24 Gateway: Figure 13 I our VRRP ple, we ll cofigure 2 routers with ip addresses of ad will be the VRRP master router cofigured o router rtr1. The etwork coectig the 2 routers is /30. Use Figure 13 as the physical layout for this example. ple: Router rtr1: rtr1(cofig)#it fa0/1 rtr1(cofig-if )#ip address rtr1(cofig-if )#o shutdow rtr1(cofig)#iterface fa0/0 rtr1(cofig-if )#ip address rtr1(cofig-if )#o shutdow rtr1(cofig-if )#vrrp 1 ip rtr1(cofig-if )#vrrp 1 priority 110 rtr1(cofig-if )#vrrp 1 preempt LearSmart Cloud Classroom: Video Traiig Mauals

44 Maual BCMSN Router rtr2: Switch wg1: rtr2(cofig)#it fa0/1 rtr2(cofig-if )#ip address rtr2(cofig-if )#o shutdow rtr2(cofig)#iterface fa0/0 rtr2(cofig-if )#ip address rtr2(cofig-if )#o shutdow rtr2(cofig-if )#vrrp 1 ip wg1#cofigure termial wg1cofig-if )#iterface fa0/1 wg1 (cofig-if )#switchport access vla 100 wg1 (cofig-if )#iterface fa0/2 wg1 (cofig-if )#switchport access vla 100 Let s verify our VRRP cofiguratio usig the show vrrp commad o rtr1 ad rtr2. rtr1#show vrrp Etheret0/0 - Group 1 State is Master Virtual IP address is Virtual MAC address is e Advertisemet iterval is sec Preemptio eabled Priority is 255 (cfgd 110) Master Router is (local), priority is 255 Master Advertisemet iterval is sec Master Dow iterval is sec rtr2#show vrrp Etheret0/0 - Group 1 State is Backup Virtual IP address is Virtual MAC address is e Advertisemet iterval is sec Preemptio eabled Priority is 100 Master Router is , priority is 255 Master Advertisemet iterval is sec Master Dow iterval is sec (expires i sec) LearSmart Cloud Classroom: Video Traiig Mauals

45 Maual BCMSN GLBP The mai differece betwee GLBP ad HSRP/VRRP is i its ability to load balace by default. With HSRP ad VRRP, there are ways to desig your etwork to load balace at the VLAN level, but this ca lead to a imbalace if oe VLAN utilizes the vast majority of traffic. GLBP is a per-mac address way to load balace while still providig gateway redudacy. GLBP routers cofigured i the same group commuicate betwee each other usig multicast hello packets. With GLBP, a router is elected to be the active virtual gateway (AVG). The AVGs resposibility is to had out virtual MAC addresses to the other routers i the GLBP group. All the other routers i the group are called active virtual forwarders (AVF). They use the same gateway IP address as the rest but with a differet MAC address. Ed devices are all cofigured with the same gateway address. The differece is that whe the ed device does a ARP lookup to get the MAC address of its gateway IP, the AVG hads out the differet MAC addresses of itself ad the other AVFs that are cofigured. This is how load balacig is achieved. A sigle GLBP group ca have up to four AVFs. If oe of the GLBP routers becomes uavailable, the other router assumes resposibility to hadle traffic for the dowed MAC address ad its ow MAC address. The ed devices ever otice because they re still sedig their traffic to the same layer 2 MAC ad layer 3 IP address. Sytax: Router#cofigure termial Router(cofig)#iterface iterface-id Router(cofig-if )# ip address ip-address mask Router(cofig-if )#glbp group ip ip-address Router(cofig-if )#glbp group priority level preempt rtr1 rtr2 Fa0/1 Fa0/1 Fa0/0 Fa0/0 Fa0/1 Fa0/2 Fa0/20 wg1 IP Add: /24 Gateway: Figure 14 LearSmart Cloud Classroom: Video Traiig Mauals

46 Maual BCMSN I our GLBP ple, we ll cofigure 2 routers with ip addresses of ad will be the GLBP group IP address that the routers will share. Router rtr1 will be cofigured as the AVG. The etwork coectig the 2 routers is /30. Use Figure 14 as the physical layout for this example. ple: Router rtr1: Router rtr2: rtr1(cofig)#it fa0/1 rtr1(cofig-if )#ip address rtr1(cofig-if )#o shutdow rtr1(cofig)#iterface fa0/0 rtr1(cofig-if )#ip address rtr1(cofig-if )#o shutdow rtr1(cofig-if )#glbp 1 ip rtr1(cofig-if )#glbp 1 priority 110 rtr1(cofig-if )#glbp 1 preempt rtr2(cofig)#it fa0/1 rtr2(cofig-if )#ip address rtr2(cofig-if )#o shutdow rtr2(cofig)#iterface fa0/0 rtr2(cofig-if )#ip address rtr2(cofig-if )#o shutdow rtr2(cofig-if )#glbp 1 ip Let s verify our GLBP cofiguratio usig the show glbp commad o rtr1 ad rtr2. rtr1#show glbp Etheret0/0 - Group 1 State is Active 2 state chages, last state chage 00:07:16 Virtual IP address is Hello time 3 sec, hold time 10 sec Next hello set i secs Redirect time 600 sec, forwarder time-out sec Preemptio eabled, mi delay 0 sec Active is local Stadby is , priority 100 (expires i sec) Priority 110 (cofigured) Weightig 100 (default 100), thresholds: lower 1, upper 100 Load balacig: roud-robi There are 2 forwarders (1 active) Forwarder 1 State is Active 1 state chage, last state chage 00:07:06 MAC address is 0007.b (default) Ower ID is 0002.fd79.fba0 Redirectio eabled Preemptio eabled, mi delay 30 sec Active is local, weightig 100 Cotiued o ext page. LearSmart Cloud Classroom: Video Traiig Mauals

47 Maual BCMSN Cotiued. Forwarder 2 State is Liste MAC address is 0007.b (leart) Ower ID is 0002.b90d.5960 Redirectio eabled, sec remaiig (maximum 600 sec) Time to live: sec (maximum sec) Preemptio eabled, mi delay 30 sec Active is (primary), weightig 100 (expires i sec) rtr2#show glbp Etheret0/0 - Group 1 State is Stadby 1 state chage, last state chage 00:00:02 Virtual IP address is Hello time 3 sec, hold time 10 sec Next hello set i secs Redirect time 600 sec, forwarder time-out sec Preemptio disabled Active is , priority 110 (expires i sec) Stadby is local Priority 100 (default) Weightig 100 (default 100), thresholds: lower 1, upper 100 Load balacig: roud-robi There are 2 forwarders (1 active) Forwarder 1 State is Liste MAC address is 0007.b (leart) Ower ID is 0002.fd79.fba0 Time to live: sec (maximum sec) Preemptio eabled, mi delay 30 sec Active is (primary), weightig 100 (expires i sec) Forwarder 2 State is Active 1 state chage, last state chage 00:00:13 MAC address is 0007.b (default) Ower ID is 0002.b90d.5960 Preemptio eabled, mi delay 30 sec Active is local, weightig 100 LearSmart Cloud Classroom: Video Traiig Mauals

48 Maual BCMSN Wireless Stadards The IEEE defies all wireless data stadards. All curret wireless stadards are based off of the origial stadard also kow as Legacy stadard. All of the stadards ru withi the 2.4 GHz or 5 GHz ulicesed ISM frequecies. Because the frequecies are ulicesed, they must be desiged to tolerate iterferece. Data, Throughput ad Coverage of Stadards b: This is the first major revisio of the stadard i It rus withi the 2.4 GHz frequecy ad has a maximum data rate of 11 Mbps. It has a maximum rage of 300 feet g: This stadard was released i It rus i the 2.4 GHz frequecy. It has a maximum data rate of 54 Mbps ad a rage of 300 feet a: This stadard operates withi the 5 GHz rage. It has a maximum data rate of 54 Mbps ad a rage of 300 feet although the sigal stregth weakes quickly therefore it is said to have a rage slightly less tha the b ad g stadards. This stadard also has 8 chaels that it uses withi the 5 GHz rage as opposed to 14 (14 i Japa) chaels that the stadards i the 2.4 GHz rage use i: This is a wireless amedmet to the Legacy stadard that icludes security features for wireless. Due to the security problems foud with the origial security specificatio: Wired Equivalet Privacy (WEP), i was put i place to offer a better method to secure wireless data i is also referred to as Wired Protected Access 2 (WPA2) : This stadard is still i the draft stages ad therefore is ot yet a official amedmet. However, the draft is curretly i revisio 2 ad it is likely that very little will chage withi this draft before it becomes official. There are already Cisco products available that use the draft 2 specificatios. This amedmet draft rus either i the 2.4 GHz or 5 GHz frequecies. It has a maximum data rate of 300 Mbps ad a rage of up to 600 feet. The biggest differece betwee ad the other amedmets is the fact that utilizes Multipleiput-Multiple-output (MIMO) techology. This techology uses multiple trasmit ad receive ateas to improve overall wireless performace. LearSmart Cloud Classroom: Video Traiig Mauals

49 Maual BCMSN Compoets ad Operatios of WLAN Topologies Cisco Airoet Wireless Access Poit: This is a wireless LAN device that trasmits ad receives wireless sigals from wireless cliets ad places them o the Local Etheret LAN for trasmissio. It acts as the coectio poit betwee the wired ad wireless etworks. Figure 15 shows a typical WAP setup o a LAN: wg1 Wired LAN WAP Figure 15 Cisco Airoet Wireless Workgroup Bridge: The workgroup bridge provides a stad-aloe wired Etheret segmet that is coected back to the mai Etheret LAN over a wireless coectio. This optio is best used whe you have several wired Etheret devices i a locatio that is difficult to pull physical cablig. Figure 16 details a workgroup bridge desig: wg1 Wired LAN WAP Workgroup Bridge Figure 16 LearSmart Cloud Classroom: Video Traiig Mauals

50 Maual BCMSN Wireless LAN Cotroller (WLC): This device helps to simplify the maagemet of a large wireless etwork ifrastructure. Usig a Cisco Wireless LAN cotroller, you ca use special access poits called Lightweight Access Poits (LWAP) that are all cotrolled through the WLC. So istead of havig hudreds or eve thousads of autoomous Access Poits (aap) to idividually maitai, all the itelligece ad cofiguratio of the LWAP is doe at the WLC. The WLC allows for ease of wireless mobility betwee access poits. This appliace is part of the Cisco Uified Wireless Network. Wireless Cotrol System (WCS): The WCS is where etwork egieers moitor, support ad maitai their LWAP etwork. A cofiguratio chage ca be made oe time o the WCS ad pushed out to some or all of the wireless access poits o the etwork. This appliace is part of the Cisco Uified Wireless Network. Wireless Locatio Appliace (WLA): This appliace works i cojuctio with the WLC ad LWAP devices to physically track the locatio of wireless devices i a large wireless etwork. It has the ability to locate the wireless devices withi a few meters. This appliace keeps track of locatio iformatio over time so it ca be used for tredig. This appliace is part of the Cisco Uified Wireless Network. Wireless LAN Cliet Adapters: The wireless LAN adapters are for ed devices that do ot have builti wireless capabilities required to joi a wireless etwork. These wireless cards come i various PCI ad CardBus forms. Cisco Recommeded Desigs Cisco wireless AP s ca be cofigured to belog i basically oe of two major desigs. The first desig is the autoomous access poit (aap) desig. The other desig is called the Cisco Uified Wireless Network. aap (autoomous) Access Poit: The autoomous AP desig is whe a full-blow wireless IOS image is placed o every access poit. Each device is maaged separately from a cofiguratio ad wireless itelligece poit of view. This type of etwork is perfect for wireless hot-spots or small wireless mesh desigs. It does ot scale well from a support stadpoit however. Cisco Uified Wireless Network: The Cisco uified etwork is for large wireless deploymets i a eterprise ifrastructure. The etwork uses a lightweight versio of the wireless IOS o each access poit. All the LWAPs are maitaied by the wireless LAN cotroller (WLC) ad wireless cotrol system (WCS). The wireless locatio appliace (WLA) is optioal but ca add the very useful wireless trackig features to the etwork. Figure 17 depicts a typical Cisco uified wireless etwork desig. LearSmart Cloud Classroom: Video Traiig Mauals

51 Maual BCMSN WLC Wired LAN WCS LWAP LWAP LWAP WLA Figure 17 Wireless Mobility Network uificatio from a wireless stadpoit icludes security policies, quality of service (QOS) ad wireless mobility. The Cisco uified wireless etwork also icorporates what s kow as wireless mobility. This wireless mobility allows for wireless uses to be completely mobile so they ca seamlessly move from locatio to locatio withi a wireless ifrastructure. Cisco Fast Secure Roamig (FSR): FSR provides the ability for a wireless cliet to roam from 1 AP to aother without the eed to re-autheticate back to a cetralized autheticatio server. Now applicatios that require uiterrupted etwork service ca be offered over a wireless etwork. These applicatios iclude wireless voice ad streamig applicatios. Iter-Subet Roamig: Cisco wireless mobility allows a wireless cliet to keep it s wireless sessio up while movig from oe IP subet to aother. The WLC creates a IP subet achor for each wireless cliet that comes o the uified wireless etwork. Whe a wireless cliet roams to a foreig subet, the traffic is forwarded to the achor subet ad moved across the LAN. This process is completely hidde from the ed user ad is highly efficiet from a latecy perspective. LearSmart Cloud Classroom: Video Traiig Mauals

52 Maual BCMSN Cofigurig a Wireless Cliet The setup ad cofiguratio of the Cisco Airoet wireless LAN cliet adapter is show below. This will guide you through the actual cofiguratio for a wireless cliet that will coect to a AP with the followig settigs: Ecryptio: 128 bit WEP key Autheticatio: Ope SSID: BCMSN Step 1: Use the Istallatio wizard to perform The Express Istallatio/Upgrade Step 2: Oce the drivers have bee successfully istalled, reboot the PC. LearSmart Cloud Classroom: Video Traiig Mauals

53 Maual BCMSN Step 3: After the PC has rebooted, lauch the Airoet Cliet Utility (ACU). Click o the Profile maager butto. Step 4: Click the Add butto to make a ew Profile. LearSmart Cloud Classroom: Video Traiig Mauals

54 Maual BCMSN Step 5: Eter a profile ame. I this case we used preplogic as our profile ame. Click the OK butto. Step 6: Eter the Cliet Name of the PC you are doig the cofiguratio o. We used preplogic-1 as our ame. Eter the SSID. The AP is cofigured with a SSID of BCMSN i this example. LearSmart Cloud Classroom: Video Traiig Mauals

55 Maual BCMSN Step 7: Click o the Network Security tab at the top. Select the Static WEP radio butto ad click the butto that says Static WEP Keys. Step 8: Eter the static WEP key. You ca eter the keys with either 40 or 128 bit key sizes. You ca also eter the key usig ASCII or Hexadecimal. Depedig o the method used, the actual umber of characters used to eter the WEP key varies: 128-bit ASCII 13 Characters 40-bit ASCII 5 Characters 128-bit Hex 26 Characters 40-bit Hex 10 Characters The AP is set with a 128-bit key. We ll eter the key usig ASCII which is prepl0g1cbcms. Note: this key is exactly 13 characters i legth. Click OK. LearSmart Cloud Classroom: Video Traiig Mauals

56 Maual BCMSN Step 9: Click OK oce we re doe settig up the ew profile. LearSmart Cloud Classroom: Video Traiig Mauals

57 Maual BCMSN Step 10: Click OK to save the ew profile amed preplogic. Step 11: Click the Butto amed Select Profile. LearSmart Cloud Classroom: Video Traiig Mauals

58 Maual BCMSN Select the profile amed preplogic from the dropdow list. Click the OK butto. Your ew profile is ow complete. You should be able to coect to the wireless AP. Security Features i a Switched Network Switch security is a importat part of the BCMSN exam. This sectio will detail some of the typical security problems ad how to setup your equipmet to prevet attacks from occurrig. MAC Address Floodig The cotet addressable memory (CAM) table holds the port to MAC address mappigs o a switch. Like all memory, it is fiite i ature ad ca oly hold a certai umber of mappigs before it fills up completely. If a CAM table becomes full, the switch basically igores the CAM table ad forwards traffic out all ports o the same VLAN. It basically turs the itelliget switch ito a bridge or hub. A attacker ca the put a siffer o the switch ad see all traffic o that VLAN. There are two recommeded methods that ca protect a etwork from the MAC address floodig attack: Port Security This iterface commad feature allows the egieer to limit the umber of MAC addresses it allows o a particular port. It is a good idea to limit the umber of MAC addresses o your access ports. Not oly does it protect agaist hackers attemptig to flood the CAM table but it also guards agaist users from addig a uauthorized switch or wireless access poit. Port security ca be cofigured to allow ay umber of MAC addresses o a port. It ca also be setup so specific MAC addresses are maually etered ito the switch (switchport port-security mac-address commad) or they ca be dyamically leared. For example, A etwork egieer ca set the port security MAC address limit to 1 (usig the switchport port-security maximum commad) ad hard code the specific MAC addresses of the device that will coect to that particular switch port. Alteratively, he/she ca set the port security to dyamically accept the first MAC address that is see o the port. If a port security violatio occurs (either too may MAC addresses see or the wrog address) the switch port ca be set to either shutdow permaetly (err-disable), shutdow for a specific period of time, or drops all iboud packets from the isecure device. This is doe usig the switchport port-security violatio commad. The default violatio is to shutdow the port. LearSmart Cloud Classroom: Video Traiig Mauals