Sefism.Network engineering: Enterprise (Cisco)

Tauseef Fayyaz

Chapter 02

Switching and VLANs

How switches learn and forward frames, how VLANs and trunks split one physical network into many, and the loop protection that keeps a campus network alive.

MAC address table

Also called CAM table, MAC learning, frame flooding, unknown unicast

What: The switch table mapping each MAC address to the port it was last seen on. Switches learn from source addresses, forward on destination addresses and flood frames for unknown destinations out of every port in the VLAN.
Why: Reading it tells you where a device is plugged in, which is the first question in most access-layer tickets.

Code

show mac address-table
show mac address-table address 0050.7966.6800
show mac address-table interface Gi1/0/5

Watch out

Expecting a silent device to appear: a switch learns a MAC only after the device sends a frame.

VLAN

Also called virtual LAN, broadcast domain, access port, voice VLAN

What: A VLAN splits one switch, or many, into separate Layer 2 networks. Each VLAN is its own broadcast domain and usually its own IP subnet. An access port carries one VLAN, plus optionally a voice VLAN for an IP phone.
Why: VLANs separate staff, guests, servers and phones without separate hardware, which limits broadcasts and gives security policy a boundary.

Code

vlan 20
 name STAFF
interface Gi1/0/5
 switchport mode access
 switchport access vlan 20
 switchport voice vlan 30
show vlan brief

Watch out

Leaving unused ports in VLAN 1 and enabled, where anyone can plug in next to your management traffic.

Trunks and 802.1Q

Also called trunk port, 802.1Q, dot1q, VLAN tag, native VLAN, allowed VLANs

What: A trunk carries many VLANs over one link by adding a 4-byte 802.1Q tag with the VLAN number to each frame. Frames in the native VLAN cross untagged.
Why: Trunks connect switches to each other, to routers and to wireless access points, so VLANs can span a building.

Code

interface Gi1/0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
show interfaces trunk

Watch out

Mismatched native VLANs on the two ends, which silently leaks traffic between VLANs.

Inter-VLAN routing

Also called SVI, switch virtual interface, router on a stick, Layer 3 switch

What: Hosts in different VLANs need a router to talk. A Layer 3 switch does it with an SVI (interface Vlan20) per VLAN; a router can do it with tagged subinterfaces on one trunk, called router on a stick.
Why: It is how a campus network lets departments reach shared servers while keeping them in separate subnets.

Code

ip routing
interface Vlan20
 ip address 10.1.20.1 255.255.255.0
 no shutdown
! router on a stick
interface Gi0/0.20
 encapsulation dot1Q 20
 ip address 10.1.20.1 255.255.255.0

Watch out

Forgetting ip routing on a Layer 3 switch: the SVIs come up but nothing is routed between them.

Spanning Tree Protocol

Also called STP, Rapid PVST+, RSTP, root bridge, root port, designated port, blocking

What: STP stops loops in a switched network by electing a root bridge and blocking redundant paths. Cisco runs Rapid PVST+, one fast-converging tree per VLAN. Ports take roles such as root, designated and alternate.
Why: Ethernet frames have no hop limit, so one loop can melt a network in seconds with a broadcast storm. STP is what makes redundant links safe.

Code

spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
show spanning-tree vlan 20

Watch out

Leaving root election to chance: the oldest switch with the lowest MAC may become root and carry every frame.

PortFast, BPDU Guard and Root Guard

Also called PortFast, BPDU Guard, Root Guard, Loop Guard, edge port

What: PortFast puts an access port straight into forwarding. BPDU Guard shuts the port if a switch appears on it. Root Guard stops a downstream switch becoming root, and Loop Guard protects against one-way links.
Why: User ports come up instantly, and a cheap switch plugged in under a desk cannot rewrite your spanning tree.

Code

interface range Gi1/0/1 - 44
 spanning-tree portfast
 spanning-tree bpduguard enable
errdisable recovery cause bpduguard

Watch out

Enabling PortFast on a port that connects to another switch, which can create a temporary loop.

EtherChannel and LACP

Also called port channel, LACP, link aggregation, LAG, 802.3ad

What: Bundling several physical links into one logical link. LACP is the standard protocol that negotiates the bundle; traffic is shared across members by a hash of addresses.
Why: You get more bandwidth and a link that survives a member failure, and STP sees one link instead of blocking all but one.

Code

interface range Gi1/0/47 - 48
 channel-group 1 mode active
interface Port-channel1
 switchport mode trunk
show etherchannel summary

Watch out

Mismatched speed, duplex, VLANs or trunk settings between members, which keeps the bundle from forming.

CDP and LLDP

Also called Cisco Discovery Protocol, LLDP, neighbour discovery

What: Discovery protocols that let directly connected devices announce their name, model, port and address. CDP is Cisco-only; LLDP is the vendor-neutral standard.
Why: They let you check a network diagram against reality and trace which switch port a phone or access point is on.

Code

show cdp neighbors detail
lldp run
show lldp neighbors

Watch out

Leaving CDP on internet-facing ports, where it gives away device models and software versions.

Go deeper