AI, ML, Development + Cisco Learning Blog Learning about Machine Learning, Artificial Intelligence, related devlopment topics and formerly Routing and Switching, Datacenter, Security and other topics, CCIE #23664, Frank Wagner

This should work, but is i labbed it out, it does not as promised. Let`s say if you have a vtp domain CISCO and one switch, that is configured in transparent mode, does belong to another domain, does not forward, these vtp messages. If you have this one switch in between the others, your vlan database will not be updated because of this domain mismatch.

This should work with vtp version 2, but does not, is i tried it today on my rack with 3560 cat switches. For vtp version 1 this behavior is normal.

Source:

http://www.cisco.com/warp/public/473/vtp_flash/

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_4_2/config/vlans.htm#xtocid79806

The main new feature introduced with 3560 catalyst switches is the private vlan feature.

It’s not that complicated as it seems to be.

Basically it a „switchport protected“ bound to vlan’s over trunk ports. It’s also similar like an RSPAN session, which is SPAN over differens switches.
So if you configure two ports as switchport protected in the same vlan on the same switch, they are not able to communicate with each other.

vlan 28

int f0/2

switchport access vl 28

switchport protected

int f0/3

switchport access vl 28

switchport protected

Now these ports are not able to communicate with each other.

This feature does not work, if ports are seperated over a trunk. At this points private vlan’s come into play.

You can define a private vlan and add isolated ports to this vlan, similiar as protected ports on the same switch. These isolated ports are also not able to communicate with each other. Vtp mode has to be in transparent mode and vlan assignments have to be made on both switches.
vtp mode transpartent

vlan 28

private-vlan primary
private-vlan association 281

vlan 281
private-vlan isolated

This defines the primary vlan and the vlan 281 where later isolated hoste are added.

Adding hosts looks like this:

inf f0/7

switchport private-vlan host-association 28 281
switchport mode private-vlan host

This adds an interface as an isolated port to the primary vlan 28.

You can now define a promiscuous port in vlan 28, which is able to communicate with these isolated ports.

f0/8

switchport private-vlan mapping 28 281
switchport mode private-vlan promiscuous

This promiscuous port will be able to communicate also with the SVI of the vlan, if there is any.

The communties are private-vlans inside a vlan, which build groups of ports that are able to communicate with each other only inside this private-vlan community. Different communities inside a vlan are also not able to talk to each other. There is no limitation for promisucous ports.
Source:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225see/scg/swpvlan.htm

Spanning-Tree is an algorithm to keep a switched network loopfree. This means if you have multiple redundant switching paths in a network, without spanning-tree i will happen, that there will be switching loops in the network, which could take the whole network down. So spanning-tree is a layer2 protocol, which algorithm is selecting one bridge as the root bridge and each port a certain role. These can be:

• Root – elected forwarding port in the STP topology
• Designated – elected forwarding port in every switched LAN segment
• Alternate – providing an alternate path to the root bridge
• Backup – loopback configuration of a blocked port

These are port states that are passed in the process of becoming a forwarding port:

• Disabled – inactive port, does not participate the STP

• Blocking – a port is at first in the blocking stage, not forwarding any frames
• Listening – STP decided this port should participate in forwarding, but not forwarding any frames at now, takes 15 seconds and then goes into
• Learning – prepares to forward frames, 15 seconds duration, after that goes into last state, which is forwarding
• Forwarding – the interface is forwarding frames

An interface can be disabled at any state of the process to become a forwading port.
The root election is based by default on the switch with the lowest MAC address value. You can also set the root bridge by setting the prioority, so the it’s the lowest priority in the STP topology.

At first every switch assumes itself as the root bridge, when it’s first powered up. It communicates with BPDU’s send every two seconds to compute the spanning-tree topology.
A BPDU (Bridge Protocol Data Units) contains the following:

• a unique ID which the switch sending the BPDU itself identifies as the root switch
• the path cost to the root
• the bridge ID of the sending switch
• the age of the message
• identifier of the sending interface
• hello, forward dely, max-age timer values

A BPDU packet conversation does have the following consequences.

• electing one switch as the root switch, counting priority (default 32768) fist and then if these are equal, the lowest MAC address
• electing a root port an each switch, except the root switch
• calculating the shortest distance to the root switch based on path cost. Path cost it based on the interface bandwidth
• selecting a designated switch which has the so called designated port, as this is the port with the lowest path cost to the root switch

There are also TCN BPDU’s (topology change notification) messages send in a spanning-tree network.
Each configured VLAN has it’s own bridge ID. As each VLAN is it own bridge. Take a look at this with „show spanning tree“. You will see that each vlan has it’s own priority. So changing the priority for a vlan change the probability of the switch being elected as the root bridge

There are several possible configuration values to setup. If you want, for example to to change the election of the root port use the „port-cost“ variable for the local switch. To change the choosen root port for a downstream switch, take the „port-priority“ variable.

For Example: SW1 and SW2 are connected over 3 trunks SW1 is the root for vlan 7. To setup SW1 as the root for vlan 7: „spanning-tree vlan 7 root primary“

Now you want to select a certain trunk for carrying the vlan 7 traffic. When you are on the root bridge use „port-priority“ to select the trunk and set a lower prio as on the others. Default is 128. If you are on the downstream switch, use „port-cost“ to let the downstream switch elect the root port, for example:

spanning-tree vlan 7 cost 20

Here are the STP costs for different link bandwidths:

• 4 Mbps – 250
• 10 Mbps – 100
• 16 Mbps – 62
• 45 Mbps – 39
• 100 Mbps – 19
• 155 Mbps – 14
• 622 Mbps – 6
• 1 Gbps – 4
• 10 Gbps – 2

So after the root bridge is selected based upon the Bridge ID/MAC address and Bridge priority, the differnet types of ports are selected based upon the cost and path cost.

The root port of each bridge is selected upon path cost to the root bridge. Each path is summarized to a path cost and the port with the lowest path cost gets the root port.

Source:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225see/scg/swstp.htm

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/sw_ntman/cwsimain/cwsi2/cwsiug2/vlan2/stpapp.htm

• Unicast, packets to every requesting address, traffic may be carried multiple times, the primary concern is the number of network connections versus the available bandwidth. Each session requires the the full bandwidth required by the application.
• Broadcast, one copy of a packet is send out to a broadcast address. Broadcast are stoped by layer 3 devices unless allowed to be forwarded. So evyer device with the same broadcast address receives the packet.
• Multicast, for transporting multimedia data, a media server sends a single copy to a predetermined multicast address, replications occurs only, when necessary

Etherchannel is for fault tollerance and you can use it to increase the bandwidth. You can bound up to to eight interface to an eitherchannel. All interfaces must be the same speed and all have to be configured as layer 2 or layer 3 interfaces. If one interface fails, the traffic is automatically redirected to the other interfaces.

Etherchannel can be configured in one of these modes:

• Port Aggregation Protocol (PAgP)
• Link Aggregation Control Protocol (LACP)
• On mode

You can setup an etherchannel in two different ways. You can set it up as layer 2 or a layer 3 interface.

There are four etherchannel modes:

• active
• auto
• desirable
• passive

Only in auto and desireable switches are exchanging PAgP packets. Only in active and passive switches are exchanging packets in LACP mode.

The following cominations are allowed for forming an etherchannel:

PAgP:

auto – desirable

desirable – auto

desirable – desirable

LACP:

active – active

active – passive

There is also on – mode, witch is for not negotiating the etherchannel between the devices. Could be usefull if one device does not support PAgP or LACP.

Here is an configuration example, where Switch 1 is trying actively to convert this link in an etherchannel, while Switch 2 will respond to these requests. The Link is also configured as a trunk link with dot1q:

Switch1:

Ports fa0/13 – 15 to be configured in the etherchannel.

sw3(config-if)#int range fa0/13 – 15
sw3(config-if-range)#switchport mode trunk

sw3(config-if-range)#channel-group 1 mode desirable
Creating a port-channel interface Port-channel 1
02:19:53: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up
02:19:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to up
Switch2:

SW2(config)#int range fa0/13 – 15
SW2(config-if-range)#switchport trunk encapsulation dot1q

SW2(config-if-range)#switchport mode trunk
SW2(config-if-range)#channel-group 1 mode auto
Creating a port-channel interface Port-channel 1
01:39:20: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up
01:39:21: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to up

Here are some commands for verifying etherchannel functions. CDP is working over etherchannel, so if you see your other switch, then etherchannel will work.
To verify the etherchannel use the commands:

show etherchannel

show pagp

show lacp

show cdp

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225see/scg/swethchl.htm

http://www.cisco.com/en/US/products/hw/switches/ps607/products_configuration_example09186a0080094789.shtml

If you setup a switch it might be a good idea to set all ports by default to portfast. But take care, this could also lead to a lot of trouble if you don’t know what you’re doing. To set all ports by default to portfast use:

spanning-tree portfast default

This stops the switch from using spanning tree on all ports. And ports are up in a few seconds.
Each port on a switch using Spanning-Tree Protocol exists in one of the following five states:

• Blocking
• Listening
• Learning
• Forwarding
• Disabled

A port moves through these five states as follows:

• From initialization to blocking
• From blocking to listening or to disabled
• From listening to learning or to disabled
• From learning to forwarding or to disabled
• From forwarding to disabled

The port always goes through these stats first.

Here is an example from a „debug spanning-tree events“ output, how long these states take. I just moved port fa0/3 in another vlan, and it would start the STP algorithm again.
00:55:55: STP: VLAN0013 Fa0/3 -> listening
00:56:10: STP: VLAN0013 Fa0/3 -> learning
00:56:25: STP: VLAN0013 Fa0/3 -> forwarding

So it take 30 seconds for a port to be available again.

With normal PC oder Server Ports, where it’s not possible to get a switching loop, it’s best to turn on portfast. Sometime DHCP client’s boot faster than the switchport is up. Then clients won’t get an IP address. The will still try to get one, but this will be delayed. So with portfast, this does not happen.

But portfast should be configured with care. If it’s not clear what kind of device will be connected, then better leave the cisco default setting.
Source:

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/sw_ntman/cwsimain/cwsi2/cwsiug2/vlan2/stpapp.htm