table of contents - atnedu.lk · 2019-06-29 · gm # interface fastethernet 0/1 # switchport trunk...

CCNP

Switching (300-115)

1 | P a g e

Table of Contents Implementing CISCO IP switched networks (300-115) ............................................................................. 5

Structure and syllabus ............................................................................................................................... 5

Layer 2 technology ...................................................................................................................................... 5

Switch Database Management (SDM) template ....................................................................................... 5

Configuration ........................................................................................................................................ 5

Verification ........................................................................................................................................... 5

Managing MAC Address Table ............................................................................................................ 5

Troubleshooting Err – Disable Recovery .................................................................................................. 6

Third party software to log into CISCO devices ....................................................................................... 6

Configure and verify Layer 2 protocols ........................................................................................................ 7

Cisco Discovery Protocol (CDP) .............................................................................................................. 7

Global CDP information ....................................................................................................................... 7

CDP verifications .................................................................................................................................. 7

CDP lab ................................................................................................................................................. 7

Link Layer Discovery Protocol (LLDP) – IEEE 802.1AB ....................................................................... 8

Type – Length – Value (TLV) information .......................................................................................... 8

Global LLDP information ..................................................................................................................... 8

To enable LLDP .................................................................................................................................... 8

To disable LLDP ................................................................................................................................... 8

LLDP verifications ................................................................................................................................ 8

UniDirectional Link Detection (UDLD) ................................................................................................... 9

UDLD configuration ............................................................................................................................. 9

Verification ........................................................................................................................................... 9

UDLD recover ...................................................................................................................................... 9

Virtual Local Area Network (VLAN) ..................................................................................................... 10

Without VLAN ................................................................................................................................... 10

With VLAN ........................................................................................................................................ 10

VLAN configuration ........................................................................................................................... 10

VLAN numbers ................................................................................................................................... 11

Terminology ........................................................................................................................................ 11

Access VLAN ..................................................................................................................................... 11

Voice VLAN ....................................................................................................................................... 11

Switched Virtual Interface (SVI) ........................................................................................................ 11

CCNP

Switching (300-115)

2 | P a g e

Voice VLAN .................................................................................................... 11

Trunk port ........................................................................................................................................... 12

InterVLAN communication with EIGRP using MLS (LAB) ............................................................. 13

Trunk ....................................................................................................................................................... 14

Trunk port ........................................................................................................................................... 14

Without trunk ...................................................................................................................................... 14

With trunk ........................................................................................................................................... 14

Trunk types ......................................................................................................................................... 14

Switchport mode and Description ....................................................................................................... 15

Native VLAN ...................................................................................................................................... 17

VLAN pruning .................................................................................................................................... 17

............................................................................................................................................................ 17

VLAN Trunking Protocol (VTP) ............................................................................................................ 18

VTP Modes and descriptions .............................................................................................................. 18

Revision number ................................................................................................................................. 18

Domain ................................................................................................................................................ 20

Pruning ................................................................................................................................................ 20

VTP practice lab ................................................................................................................................. 20

Spanning-Tree Protocol (STP) (IEEE 802.1D) ....................................................................................... 21

The issues before STP ......................................................................................................................... 21

Introduction to STP ............................................................................................................................. 22

STP port states .................................................................................................................................... 22

Bridge Protocol Data Unit (BPDU) .................................................................................................... 23

MSTP theory ....................................................................................................................................... 26

Rapid PVST + ..................................................................................................................................... 27

Features that decrease the convergence time ...................................................................................... 28

BPDU filter ......................................................................................................................................... 30

Root guard ........................................................................................................................................... 30

Loop guard .......................................................................................................................................... 30

Stack Wise .............................................................................................................................................. 31

7-Stack Wise Advantages ................................................................................................................... 31

Stack wise and stack wise plus ........................................................................................................... 31

Switched Port ANalizer (SPAN)............................................................................................................. 31

................................................................................................................................................................ 31

Remote Switched Port ANalizer (RSPAN) ............................................................................................ 32

CCNP

Switching (300-115)

3 | P a g e

Infrastructure services .......................................................................................... 33

First Hop Redundancy Protocol (FHRP) ............................................................................................ 33

Hot Standby Router Protocol (HSRP) ................................................................................................ 34

Virtual Router Redundancy Protocol (VRRP) .................................................................................... 35

Gateway Load Balancing Protocol (GLBP) ........................................................................................ 36

INFASTRUCTURE SECURITY ........................................................................................................... 37

(Securing cisco catalyst switch) .............................................................................................................. 37

MAC flooding attack .......................................................................................................................... 37

Solution ................................................................................................................................................... 37

Port security ........................................................................................................................................ 37

Violation methods ............................................................................................................................... 37

Error disable port automatic recovery ..................................................................................................... 37

Strom control .......................................................................................................................................... 38

Private VLANS ....................................................................................................................................... 39

Primary VLANS ..................................................................................................................................... 39

Community VLAN ................................................................................................................................. 39

Isolated VLAN ........................................................................................................................................ 39

Promiscuous port .................................................................................................................................... 39

Community port ...................................................................................................................................... 39

Isolated port ............................................................................................................................................ 39

DHCP Snooping...................................................................................................................................... 41

DHCP Spoofing Attack ....................................................................................................................... 41

Router .................................................................................................................................................. 41

DHCP Spoofing .................................................................................................................................. 41

DHCP Snooping .................................................................................................................................. 41

DHCP Option 82 ................................................................................................................................. 41

IP Source guard ....................................................................................................................................... 42

IP Snooping ......................................................................................................................................... 42

Unicast reverse path forwarding (URPF) ............................................................................................ 42

IP Source guard ................................................................................................................................... 42

Dynamic ARP Inspection ....................................................................................................................... 43

Gratuitous ARP MAN- IN- THE- MIDDLE Attack ........................................................................... 43

Authentication, Authorization & Accounting (AAA) ............................................................................. 44

CCNP

Switching (300-115)

4 | P a g e

CCNP

Switching (300-115)

5 | P a g e

Implementing CISCO IP switched networks (300-115)

Structure and syllabus 1. Layer 2 technology 65%

2. Infrastructure security 20%

3. Infrastructure services 15%

Layer 2 technology

Switch Database Management (SDM) template

• Collection of settings that can allocate a switch’s resource (Eg: TCAM resource) in different

ways, depending on the role of the switch.

TCAM: Ternary Content Addressable Memory

Configuration

G.M # SDM prefer ?

Access –

The access template maximizes system resource for Access Control List (ACL)

to accommodate a large number of ACLs.

Default –

The default template gives balance to all functions.

Routing –

The routing template maximizes system resources for IPv4 unicast routing.

Typically required for a router or aggregator in the center of a network.

VLANs –

The VLAN template disables routing and supports the maximum number of

unicast MAC address (clients). It would typically be selected for a layer 2 switch.

Verification

PM# show SDM prefer

PM# Show platform team utilization

Managing MAC Address Table

PM # Show MAC Address – Table

PM # Show MAC Address – Table dynamic

PM # Show MAC Address – Table static

PM # Show MAC Address – Table count

PM # Show MAC Address – Table aging – time

To clear dynamic MAC Address – Table

PM # Clear MAC Address – Table dynamic

Configuring MAC – Address Statically

GM # MAC Address – Table static ______________ VLAN ______ Interface __________

CCNP

Switching (300-115)

6 | P a g e

Troubleshooting Err – Disable Recovery

Configuration

IM # Switchport mode access

IM # Switchport port – security

IM # Switchport port – security maximum _____

IM # Switchport port – security MAC – Address ___________________

IM # Switchport port – security violation ________________________

(Protect/Restrict/Shutdown)

Verification

PM # Show running – config

PM # Show port – security

PM # Show port – security address

PM # Show port – security interface _________

Err – disable recovery

GM # Errdisable recovery cause psecur-violation

GM # Errdisable recovery interval ________

Third party software to log into CISCO devices

• Putty

• Secure CRT

• Hyper terminal

• Super Putty

• Terra team

Sw1

CCNP

Switching (300-115)

7 | P a g e

Configure and verify Layer 2 protocols

Cisco Discovery Protocol (CDP)

• A cisco proprietary protocol that allows cisco devices to dynamically discover other cisco devices

that are layer 2 adjacent.

Global CDP information

Sending CDP packets every 60 second

Sending hold time value 180 second

CDP verifications

PM# Show CDP

PM# Show CDP neighbors

PM# Show CDP entry *

PM# Show CDP neighbors detail

CDP lab

To enable CDP

GM# CDP run

To disable CDP

GM# no CDP run

CDP timers

GM# CDP timers 60

GM# CDP hold time 180

CDP versions

GM# CDP advertise – v2

CCNP

Switching (300-115)

8 | P a g e

Link Layer Discovery Protocol (LLDP) – IEEE 802.1AB

• An industry standard protocol that allows network devices that supporting LLDP (that are layer 2

adjacent) to dynamically discover other.

Type – Length – Value (TLV) information

• Information about a specific characteristic of an LLDP – speaking devices, which can be

advertised to neighboring LLDP – speaking device.

Global LLDP information

Status – Active

LLDP advertise sends every 30 second

LLDP hold time advertise 102 second

LLDP interface re-initialization delay to 2 second

To enable LLDP

GM# LLDP run

To disable LLDP

GM# no LLDP receive

GM# no LLDP transmit

LLDP verifications

PM# show LLDP

PM# show LLDP neighbors

PM# show LLDP neighbors detail

CCNP

Switching (300-115)

9 | P a g e

UniDirectional Link Detection (UDLD)

UDLD configuration

GM# UDLD ?

Normal – Generate syslog messages

Aggressive – Port will be err – disable state

• If we want to enable in copper ports, have to configure under the interface mode.

GM# interface fastethernet 0/1

IM# UDLD port aggressive

Verification

PM# Show running-config

UDLD recover

PM# Show reset

CCNP

Switching (300-115)

10 | P a g e

Virtual Local Area Network (VLAN)

Without VLAN

With VLAN

VLAN configuration

Creating VLAN

GM # VLAN 2

# Name ______

(Name)

Verification

PM# Show VLAN

PM# Show VLAN _____

(ID)

PM# Show VLAN brief

CCNP

Switching (300-115)

11 | P a g e

VLAN numbers

0 – Reserved

1 – Default

1002 – FDDI-Default

1003 – TR-Default

1004 – FD net

1005 – TR net

1006-4094 – Extended

4095 – Reserved

Terminology

Access VLAN

• The VLAN which an access port is assigned.

Voice VLAN

• If configured, enables minimum trunking to support voice traffic in addition to data traffic on an

access port.

Switched Virtual Interface (SVI)

• A virtual interface which provides a routed gateway in and out of a VLAN.

• Layer 3 switch only can create SVI.

Access port configuration

GM # Interface Fastethernet 0/1

# Switchport mode access

# Switchport access VLAN 10

Verification


PM # Show VLAN

Voice VLAN

• A VLAN that can be configured on a cisco catalyst switch for the purpose of carrying voice

packets to end from IP phones.

This port can be

1. Single VLAN access port

2. Multi VLAN access port

3. Trunk port

Voice VLAN 40 Data VLAN 30

CCNP

Switching (300-115)

12 | P a g e

Configuration

GM # Interface fastethernet 0/1

# Switchport mode access

# Switchport voice VLAN

Verification

PM # Show VLAN


Single VLAN access port

• Access port

• One VLAN

• Useful for software based or third party IP phones

• Allows the IP phones to mark on IEEE 802.1p marking.

IEEE 802.1p

A layer 2 QOS marking similar to a COS marking, that is send over a non-trunking connection. 4

bytes are added to a layer 2 frame with 3 bits in those 4 bytes are used for priority marking and

with 12 bits in the VLAN field send to all zeros.

Class Of Service (COS)

A layer 2 Quality Of Service (QOS) marking sends over trunk in the range of 0 – 7 (where value

6 and 7 are reserved for network use). Cisco ip phones automatically send the COS of voice

frame in the range of 0 – 5.

Multiple VLAN access port

• Access port

• Two VLANs

• The cisco IP phones learns it’s VLAN via CDP message

• Does not works with LLDP – MED

• Frame look like dot1q trunk frame

Link Layer Discovery Protocol – Media Endpoint Discovery (LLDP - MED) An extension of LLDP designated to work between network endpoints (Eg – IP phones) and

infrastructure devices (Eg – Switches).

Trunk port

• Trunk port

• Multiple VLANs

• Comparable with both CDP and LLDP – MED

• Frames are dot1q trunk frames

• No need of VLAN pruning

SVI configuration

GM # Interface VLAN 20

# IP address 10.1.1.1 255.255.255.0

# No shutdown

CCNP

Switching (300-115)

13 | P a g e

InterVLAN communication with EIGRP using MLS (LAB)

CCNP

Switching (300-115)

14 | P a g e

Trunk

Trunk port

A switch port that can simultaneously carry traffic for multiple VLAN.

Without trunk

With trunk

Trunk types

802.1Q ISL

Header size 4 bytes 26 bytes

Trailer size N/A 4 bytes

Standard IEEE ISL

Maximum VLANs 4094 1000

R1

Sales IT

R1

CCNP

Switching (300-115)

15 | P a g e

Inter Switch Link (ISL)

A cisco proprietary Ethernet trunking type which adds 30 bytes of header (26 bytes of payload and 4

bytes of checksum) to each trunk frame.

Untagged frame Tagged frame

IEEE 802.1Q

An industry standard Ethernet trunking type, which adds 4 bytes tag to each trunk frame except the

frames belongs to the native VLAN.

Untagged frame Tagged frame (802.1Q)

Dynamic Trunking Protocol (DTP)

A cisco proprietary protocol that allows a switch port to dynamically negotiate that formation of a trunk

between two switches.

Switchport mode and Description

Access –

• Forces a port to operate as an access port

Trunk –

• Forces a port to operate as a trunk port

Dynamic desirable –

• Initiate the negotiation of a trunk

Dynamic Auto –

• Passively waits for the remote switch to initiate the negotiation of a trunk.

DTP DTP

Fa0/1 Fa0/1

Destination

MAC

Source

MAC

Type Destination

MAC

Source

MAC

Type ISL

Header

FCS

Destination

MAC

Source

MAC

Type Destination

MAC

Source

MAC

802.1Q Type

CCNP

Switching (300-115)

16 | P a g e

Switch 1 mode Switch 2 mode Trunk forward

Access Any

Trunk Dynamic desirable ✓

Trunk Dynamic auto ✓

Trunk Trunk ✓

Dynamic desirable Dynamic desirable ✓

Dynamic desirable Dynamic auto ✓

Dynamic auto Dynamic auto

Trunk port configuration

Option 1 (2950 and below)


# Switchport mode trunk

Option 2 (3560 above)


# Switchport trunk encapsulation Dot1q

(Dot1q/ISL)

# Switchport mode trunk

CCNP

Switching (300-115)

17 | P a g e

Native VLAN

• By default frames are in this VLAN are untagged when sends across a trunk link.

Configuration


# Switchport native VLAN 2

VLAN pruning

Option 1


# Switchport trunk allowed VLAN 2

Option 2


# Switchport trunk except VLAN 3

Allow V2 V2 V3 V2

Access port

remove the tag

Remove the tag

Tag

Trunk type

ISL 802.1q

Native VLAN

Feature

V2 V3 V2 V3

Trunk

V2 V3 V2 V3

Trunk

Write the tag

CCNP

Switching (300-115)

18 | P a g e

VLAN Trunking Protocol (VTP)

• VTP versions are

Version 1

Version 2

Version 3

Conditions

• Same VTP domain

• Same trunk links

• Same passwords

VTP Modes and descriptions

Server

• Can be used to create, delete and modify VLANs

• Update its VLAN database based on received advertisements.

• Forward received VTP messages.

• Can originate VTP advertisement.

Client

• Can’t be used to create, delete and modify VLANs

• Update its VLAN database based on received advertisements.


• Can originate VTP advertisement.

Transparent

• Can be used to create, delete and modify VLANs

• Doesn’t update its VLAN database based on received advertisements.


• Doesn’t originate VTP advertisement.

Revision number

A VLAN advertised via VTP including the version of a switches VLAN database, which gets increment

by one for any changes made to that VLAN database.

CCNP

Switching (300-115)

19 | P a g e

VTP configuration

GM # VTP mode _______________________

(Server/Client/Transparent)

GM # VTP domain CCNP

(Name)

GM # VTP password CISCO123

(Version)

GM # VTP pruning

Show commands

PM # Show VTP status

PM # Show VTP password

PM # VTP mode transparent

PM # delete flash : VLAN.dat

PM # erase startup-config

PM # Reload

Client Client

Client Transparent

Server

V2 V3 V4

V2 V3 V4

V2 V3 V4

V2 V3 V4

V2 V3 V4

Domain name “CCNP”

Password “CISCO123”

Server

Client Client

Client Transparent

Server

V2 V3 V4

V2 V3 V4

V2 V3 V4

V2 V3 V4

V2

V

V

V

V3 V4

CCNP

Switching (300-115)

20 | P a g e

Domain

Common to all switches which are participating in VTP.

Pruning

VLAN not having any access ports on an end switches are removed from the trunk to reduce

flooded traffic.

VTP practice lab

Server

V2 V3 V4

Client

V2 V3 V4

Client

V2 V3 V4

Client

V2 V3 V4

Have to configure VTP in servers

Core B Core A

CCNP

Switching (300-115)

21 | P a g e

Spanning-Tree Protocol (STP) (IEEE 802.1D)

The issues before STP

While implementing a network we always have a redundant link in order to avoid interruption of service.

But engineers’ faces below problems while connecting switches with redundant links.

• MAC address table corruption

.

• Broadcast storm

When two or more switches connected with an addition link for the purpose of

redundancy, the broadcast frame circulates endlessly within those switches. It happens

because the layer two frame has no TTL (Time To Live) field as layer three

TTL (Time To Live)

It’s a value in an IP packet’s header that is decremented by one when a packet enters router interface each

time. Since switches always works with MAC address, the layer two topology will never have TTL value.

Note – STP is the solution for above problems.

Sw1

Sw2

CCNP

Switching (300-115)

22 | P a g e

Introduction to STP

In the mid 80’s Radia Perlman developed STP who was worked at DEC (Digital Equipment

Cooperation). In 1990 the standard was borrowed by IEEE (Institute of Electrical and Electronic

Engineering) and they named the standard as IEEE 802.1D.

STP port states

Identifying STP port states

Root bridge

A STP topology has a single root bridge. The bridge (or switch) with the lowest bridge ID (UDI)

is selected as a root bridge.

Root port

The port on a non-root bridge which is closest to the root bridge in terms of cost.

Designated port

Each segment will have one designated port.

Non-designated port

Ports that block traffic in order to deliver a loop free layer 2 topology.

Disable port

A port that is administratively shutdown.

Port speed Port cost

10 Mbps 100

100 Mbps 19

1 Gbps 4

10 Gbps 2

Fa0/1 Fa0/1

MAC – 000d-2824-7c80

Priority - 32768

MAC – 0018-c985-1d04

Priority - 32768

MAC – 0018-67ab-2d00

Priority - 32768

CCNP

Switching (300-115)

23 | P a g e

Bridge Protocol Data Unit (BPDU)

A type of a packet exchange in a STP topology that is use to determine which switch is the root bridge.

BPDU packet

STP convergence time

Bridge ID

Bridge priority (0 - 61440)

Default 32768

MAC address

64 bits

Fa0/1 Fa0/1

MAC – 000d-2824-7c80

Priority - 32768

MAC – 0018-c985-1d04

Priority - 32768

MAC – 0018-67ab-2d00

Priority - 32768

Forwarding

Learning 15sec

Listing 15sec

Blocking 20sec

CCNP

Switching (300-115)

24 | P a g e

STP variants

• IEEE 802.1D

All VLANs use a common STP topology.

Common Spanning – Tree Protocol (CST)

All VLANs will use one instance of STP.

• Per VLAN Spanning – Tree (PVST) used over ISL trunk.

• Per VLAN Spanning – Tree Plus (PVST +) used over IEEE 802.1Q trunk.

• Multiple Instance Spanning – Tree Protocol (MISTP) used over ISL

• Multiple Spanning – Tree (MSTP) used over IEEE 802.1S trunk.

Root for VLAN 100

Root for VLAN 200

Root for VLAN 300 A B

C D

Root for VLAN 100

Root for VLAN 200

A B

C D

Root for VLAN 300

A B

C D

Instance 1 Instance 2

VLAN 100 VLAN 200

VLAN 300


A B

C D

CCNP

Switching (300-115)

25 | P a g e

• Rapid Per VLAN Spanning – Tree Plus (Rapid PVST +) used over ISL

trunk.

• Rapid Spanning – Tree Protocol (RSTP) used over IEEE 802.1W trunk.

STP configuration

Enable STP

GM # Spanning – Tree mode PVST

Change the bridge priority

GM # Spanning – Tree VLAN 10 priority _________

(0-61440)

Timers in sec

GM # Spanning – Tree VLAN 10_ hello-time _2_

GM # Spanning – Tree VLAN 10_ forward-time _15_

GM # Spanning – Tree VLAN 10_ max-time _20_

Verification commands

PM # Show Spanning – Tree

PM # Show Spanning – Tree detail

PM # Show Spanning – Tree VLAN _________

(VLAN ID)

PM # Show Spanning – Tree summary

PM # Show VLAN

PM # Show VLAN _________

(VLAN ID)

STP primary or secondary command

GM # Spanning – Tree VLAN 10_ root Primary

GM # Spanning – Tree VLAN 10_ root secondary

Root for VLAN 100

Root for VLAN 200

A B

C

Root for VLAN 300

The goal of RSTP is

fast convergence

D

(Priority value should be

given in increment of 4096)

CCNP

Switching (300-115)

26 | P a g e

MSTP theory

• Multiple Spanning – Tree protocol (MSTP) used over IEEE 802.1W trunk.

• Also written as “Multiple Spanning – Tree (MST)”.

• MSTP configuration

Name

Revision number

Mapping table

MSTP instance (Huge number of VLANs)

An STP process which defines the root bridge, root ports, designated ports and blocked ports for a

group of switches that can be shared by multiple VLANs.

MSTP region

A group of switches sharing the configuration attributes such as region name, revision number

and VLAN mapping table.

Configuration

GM # Spanning – Tree mode MST

Region name and Revision number

GM # Spanning – Tree MST configuration

# Name _______

(Name)

# Revision ________

(Number)

A B

C D


A B

C D

Instance VLANs Root

1 1,2,3,4 Sw A

2 5,6,7,8 Sw B

Instance VLAN Primary root Secondary root

1 100,300 Sw1 Sw3

2 200 Sw3 Sw1

Sw2 Sw3

Sw1

CCNP

Switching (300-115)

27 | P a g e

VLAN mapping

GM # Spanning – Tree MST configuration

# Instance ________ VLAN _______

(Number) (ID)

MSTP primary and secondary

GM # Spanning – Tree MST ________________ root _________________

(Instance number) (Primary/Secondary)

Verification


PM # Show Spanning – Tree MST configuration

PM # Show Spanning – Tree VLAN __________

(ID)

Rapid PVST +

Root bridge

A STP topology has a single root bridge. The bridge (or switch) with the lowest bridge ID (UDI)

is selected as a root bridge.

Root port

The port on a non-root bridge which is closest to the root bridge in terms of cost.

Designated port

Each segment will have one designated port.

Non-designated port

Ports that block traffic in order to deliver a loop free layer 2 topology.

Disable port

A port that is administratively shutdown.

Alternate port

A port on a switch that is currently discarding data frames, but could provide an alternate path to

reach the root bridge. (That is an alternative to the root port)

Backup port

A port currently discarding data frames, although it could be an alternate path to the root bridge,

and it’s also acting as a redundant link to a shared segment.

DP

/FW

D

Disable

Root bridge

Point-to-Point RP/FWD

AP/BLK

Back

up

DP/FWD

Sw1

Sw2 Sw3

Hub

DP/FWD Shared segment

Edge port

CCNP

Switching (300-115)

28 | P a g e

Port states

Discarding

Data is not being forwarded thru the port (Seen on alternate, backup and disabled ports)

Learning

The switch is learning MAC addresses which available on the port (Seen when a port is

transitioning into forwarding)

Forwarding

Data is being forwarded on the ports (Seen on the root and designated port)

Link types

Point to Point

A link type where the connected port is running in full-duplex mode and where the link is

typically connecting one switch with another switch.

Shared

A link type where the connected port is running in half-duplex mode and where the link is

typically connecting a switch to a shared media hub.

Edge port

A link type where the connected port is not connected to another switch or shared media hub.

Instead connected to a network end point.

Features that decrease the convergence time

Uplink fast

Typically used on an access port to re-converge in the event of a direct link failure.

• GM # Spanning – Tree uplink fast

• PM # Show Spanning – Tree uplink fast

No need if Rapid STP is enabled (mostly its build in)

Root bridge

Point-to-Point RP/FWD

AP/BLK

Back

up

DP/FWD

Sw1

Sw2 Sw3

Hub

DP/FWD Shared segment

Edge port

Distribution layer

Core layer

Access layer

CCNP

Switching (300-115)

29 | P a g e

Backbone fast

Allows a switch to initiate re-convergence in the event of an indirect link failure.

Configure on all switches.

Inferior BPDU

A BPDU from a switch

climbing that the switch is the root bridge, when the switch topology contains another switch sending out

the BPDUs with lower bridge ID.

GM # Spanning – Tree uplink fast

PM # Show Spanning – Tree uplink fast

Port fast

Allows a switchport to transition to the forwarding state almost instantly when an end station connects to

that port.

Configuration on end points

GM # Interface fastethernet ___

# Spanning – Tree portfast

OR

Enable globally will be applied on non-trunking ports

GM # Spanning – Tree port fast default

Fa0/1 Fa0/1 Fa0/1

This switch will think him as a root bridge

Then the block port will send inferior BPDU

Sw3

Sw2

Sw1

Fa0/1 Fa0/1 Fa0/1

1. This switch will think him as a

root bridge

2. Then the block port will send

inferior BPDU

Root

Bri

dge

3. Sends a RLQ to Sw1

(Root Link Query)

asking that “Do I still

have any path to the

root bridge”.

4. Replies RLQ

reply.

5. Sw3 will tell Sw2 that “Sw1 is the root

bridge”

CCNP

Switching (300-115)

30 | P a g e

Verification

PM # Show Spanning – Tree interface fastethernet ___

Features that increases STP stability

BPDU Guard

• STP feature that can help to preserve the stability of a STP topology by placing a port into an

error – disable state if a BPDU is received on that port. (Works along with portfast)

• Should be enable on ports which are enabled with portfast.

• Can be enable globally OR port – by – port basis.

Port – by – port


# Spanning – Tree BPDUguard enable

Globally

GM # Spanning – Tree portfast BPDUguard default

Verification


BPDU filter

• STP feature that can help to preserve the stability of a STP topology (although it also runs the risk

of introducing loops) by suppressing the transmission of BPDUs from specific switch port.

• Prevents the ports from sending BPDUs.

• Should only use when necessary.

• Most dangerous when enable at the port level.

Port – by – port


# Spanning – Tree BPDUfilter enable

Globally

GM # Spanning – Tree portfast BPDUfilter default

Verification

PM # Show Spanning – Tree interface fastethernet ___

Root guard

• A STP feature that can help to preserve the stability of STP topology by placing a port into a root

inconsistence state if a superior BPDU arrives on a port which the root bridge is not expected.

Loop guard

• A STP feature that can help to preserve the stability of STP topology by placing a port into a loop

inconsistence state if a non-designated port stops receiving BPDUs

CCNP

Switching (300-115)

31 | P a g e

Stack Wise

7-Stack Wise Advantages

• As many as 9 switches in a stack.

• Single management IP address.

• Redundant interconnect cable connection.

• Automatic election and re-election of master switch

Stack wise and stack wise plus

• Cisco catalyst 3750-E, 3750-X

• Cisco catalyst 3850

Verification

PM # Show switch

PM # Show switch Stack-port

PM # Show platform stack manager all

Switched Port ANalizer (SPAN)

Configuration

GM # Monitor session _____1_____ source interface fastethernet _0/3_

(Session No) (Interface) (No)

GM # Monitor session _____1_____ destination interface fastethernet _0/2_


Verification

PM # Show monitor

Sw1

Sw2

Sw3

Sw4

Sw5

Sw6

Sw7

Interconnect

cables

Fa0/1 Fa0/3

Fa0/2

Server Client

Sniffer

CCNP

Switching (300-115)

32 | P a g e

Remote Switched Port ANalizer (RSPAN)

Configuration

GM # VLAN __50__

# Name RSPAN

# Remote – SPAN

# Exit

GM # Monitor session ____________ source interface _________ ____


GM # Monitor session ____________ destination interface VLAN _____

(Session No) (ID)

Verification

PM # Show monitor

Trunk

Sw2 Sw1

Fa0/23

Fa0/24 Fa0/24

Fa0/5 Fa0/4

Client

Server

Sniffer

CCNP

Switching (300-115)

33 | P a g e

Infrastructure services

First Hop Redundancy Protocol (FHRP)

FHRP

HSRP VRRP GLBP

D/G

10.1.1.1

Fa0/1 10.1.1.3

Fa0/0

10.1.1.2

Dialog SLT

Internet

Virtual IP 10.1.1.1

CCNP

Switching (300-115)

34 | P a g e

Hot Standby Router Protocol (HSRP)

Configuration

IM # Standby ______________ IP ____________

(Standby no) (Virtual IP)

IM # Standby ______________ Preempt

(Standby no)

IM # Standby ______________ Priority ____________

(Standby no) (Value)

IM # Standby ______________ Track ___________ _________ _____________

(Standby no) (INT Name) (INT No) (Priority Value)

Verification

PM # Show Standby

D/G 10.1.1.1

Fa0/1 10.1.1.3

Fa0/0

10.1.1.2

Dialog SLT

Internet

Virtual IP 10.1.1.1

Virtual MAC

0000.0C07.AC____

OUI HSRP HSRP

number

• Default Priority 100

HSRP Timers Multicast Address

Hello 3 sec 224.0.0.2

Dead 10 sec 224.0.0.102

• Preempt default disable

CCNP

Switching (300-115)

35 | P a g e

Virtual Router Redundancy Protocol (VRRP)

Configuration

IM # VRRP _______________ IP ___________

(VRRP group no) (Virtual IP)

IM # VRRP _______________ Preempt

(VRRP group no)

IM # VRRP _______________ Priority ____________

(VRRP group no) (Value)

IM # VRRP ________________ Track ___________ _________ _____________

(VRRP group no) (INT Name) (INT No) (Priority Value)

Verification

PM # Show VRRP

Backup Master

D/G 10.1.1.1

Fa0/1 10.1.1.3

Fa0/0

10.1.1.2

Dialog SLT

Internet

Virtual IP 10.1.1.1

Virtual MAC

0000.0C07.AC ____

OUI VRRP VRRP

number


VRRP Timers Multicast Address

Hello 3 sec 224.0.0.18

Dead 3 sec

• Preempt default enable

CCNP

Switching (300-115)

36 | P a g e

Gateway Load Balancing Protocol (GLBP)

Configuration

IM # GLBP ____________ IP ____________

(Group no) (Virtual IP)

IM # GLBP ______________ Preempt

(Group no)

IM # GLBP ______________ Priority ____________

(Group no) (Value)

IM # GLBP ____________ Track ___________ _________ _____________

(Group no) (INT Name) (INT No) (Priority Value)

Verification

PM # Show GLBP

R2

R3 R1

D/G 10.1.1.1

Fa0/1 10.1.1.3

Fa0/0

10.1.1.2

Dialog SLT

Internet

Virtual IP 10.1.1.1

Virtual MAC

0000.0C07.AC ____

OUI GLBP GLBP

number


VRRP Timers

Hello 3 sec

Dead 10 sec

• Preempt default enable

CCNP

Switching (300-115)

37 | P a g e

INFASTRUCTURE SECURITY

(Securing cisco catalyst switch)

MAC flooding attack

Occur when an attacker overflows a switches CAM table by sending multiple frames into the switches,

each claiming to be from a different MAC address.

(NOTE: This causes the switch to act much like a hub, meaning that the attacker can capture packet

following the switch).

Solution

Port security

A cisco catalyst feature that can make sure we don’t have too many MAC address or only disallowed

MAC address connected of a specific switch port.

Sticky- Configure dynamic source address as sticky.

Violation methods

• Protect

A port security violation action that allows permitted MAC address to flow through a

port, while disallowed MAC address are dropped.

• Restrict

A port security violation action that allows permitted MAC address to flow through a

port, drops disallowed MAC address and increments that switches security violation

count.

• Shutdown

A port security violation action that places a port in the error disable state and sends a

SNMP trap (If the switch is configured for SNMP)

Error disable port automatic recovery A cisco catalyst switch feature that allows a port in an error disable state to attempt to come out of that

state if the condition causing the port to be in the error disable state has been resolved.

CAM – Table

overflow

Different MAC – Address

CCNP

Switching (300-115)

38 | P a g e

Strom control A cisco catalyst switch feature that can detect a multicast, broadcast or unicast traffic Strom on a switch

port and respond by putting the port in to an error disable state and/or sending SNMP trap.

Configuration

GM # Interface fastethernet ____

# Storm – control broadcast level ____________________ _____________________

(Rising threshold BW %) (Falling threshold BW %

# Storm – control multicast level BPS ____________________ ____________________

# Storm – control multicast level BPS ____________________

# Storm – control action

Verification

PM # Storm – control

CCNP

Switching (300-115)

39 | P a g e

Private VLANS VLANS inside of another VLAN which are isolated one another at layer 2, but can communicate with

another using layer 3 routing.

Primary VLANS A VLAN that can contain a collection of private VLAN (IE subdomain) (NOTE: All ports belonging to

the private VLANS should also be configured to belong to the private VLAN).

Community VLAN A type of private VLAN that can certain multiple port connected to the hosts that are able to communicate

with one another at layer 2.

Isolated VLAN A type of VLAN contain one hosts port that cannot communicate at layer 2 with port in any other private

VLAN.

Promiscuous port A port assigned to the primary VLAN can communicate with all community and isolated port.

Community port A port belonging to a community VLAN that shares a broadcast domain with other ports in the

community VLAN.

Isolated port A port belonging to an isolated VLAN that resides in its own broadcast domain.

Community VLAN: 151

Isolated VLAN: 152 Isolated VLAN: 153

Primary VLAN: 150

CCNP

Switching (300-115)

40 | P a g e

Configuration

GM # VTP mode Transparent

GM # VLAN 150

# Private – VLAN Primary

GM # VLAN 151

# Private – VLAN Community

GM # VLAN 152

# Private – VLAN Isolated

GM # VLAN 153

# Private – VLAN Isolated

IM # Switchport mode private – VLAN

Switch

Router

CCNP

Switching (300-115)

41 | P a g e

DHCP Snooping

DHCP Spoofing Attack

Router

GM # IP helper – address

• A command that allows a

router to forward a DHCP

broadcast (i.e. that DHCP

discover message) to a DHCP

server on a different subnet.

DHCP Spoofing

An attack where attacker has a DHCP sever, which responds to a DHCP discovery message sent from a

DHCP client. (NOTE: If the client user attacker’s DHCP sever, If can be convinced that is default

gateway is that IP address of one of the attacker’s devices).

DHCP Snooping

Allows a cisco catalyst switch port to reject packets coming in from a DHCP sever. If that port is set to an

untrusted state.

Configuration

GM # IP DHCP snooping

GM # IP DHCP snooping VLAN _______

Trusted port configuration

IM # IP DHCP snooping trust

Verification

PM # Show IP DHCP snooping

DHCP Option 82

A DHCP request packet to contain information indication the switch port from which the DHCP request

come.

Snooping

Untrusted DHCP

Trust

DHCP Client

Rogue DHCP

server

Cooperate

DHCP server

Switch

DHCP works with DORA

process.

D – Discover

O – Offer

R – Request

A – Acknowledgement

CCNP

Switching (300-115)

42 | P a g e

IP Source guard

IP Snooping

An attack where a malicious user falsifies (IE Spoofs). There IP address to an IP address that is allow the

access secured resource.

Unicast reverse path forwarding (URPF)

A router feature that can block a packet arriving on an interface if the router’s IP routing table indicate a

different interface should be used to reach the packets source IP address.

IP Source guard

A switch feature that creates an IP address (And optionally MAC address) to port mapping table, and can

drop a packet arriving on a specific port from a device claiming to have a source IP address. (And

optionally a source MAC address) mat is not consistent with the mapping table.

Configuration

❖ Remember DHCP snooping is already enable.

❖ Enable to untrusted port.

GM # Interface range fastethernet _____

# IP verify source

Verification

PM # Show verify Source

Authorized Client

10.1.1.100

Attacker

10.1.1.1

Secured Server

R1 I have an ACL that

only allow IP address

10.1.1.100 to reach the

secured server.

IP Source Guard

CCNP

Switching (300-115)

43 | P a g e

Dynamic ARP Inspection

Gratuitous ARP MAN- IN- THE- MIDDLE Attack

An attack where the attacker send unsolicited ARP replies to the attack target claiming that the attacker’s

MAC address of the attack to gets default gateway.

NOTE: Dynamic ARP inspection statics can be viewed using the show IP ARP inspection command.

Configuration

❖ Remember already enable DHCP snooping

GM # IP ARP inspection VLAN _1_

Fa 1/0/1

IM # IP ARP inspection trust

❖ Dynamic ARP inspection statics can be viewed using the “show IP ARP inspection” command.

R1

ISP

Fastethernet 0/0

IP 10.1.1.0/24

MAC – DDDD – DDDD -DDDD

CCNP

Switching (300-115)

44 | P a g e

Authentication, Authorization & Accounting (AAA)

1. Authentication – Who are you? (User name or password)

2. Authorization – What are you allowed to do?

3. Accounting – What did you do?

TACACS + RADIUS

Cisco proprietary

TCP

Separate authentication, authorization,

accounting functions

Two-way challenge response encrypts

entry password

Industry standard

UDP

Combines authentication, authorization,

accounting functions

One-way challenge response only encrypt

password

Configuration

Enable AAA

GM # AAA new – model

Config the server

GM # Radius – Server host 10.10.10.10 key CISCO

GM # Radius – Server host 20.20.20.20 key CISCO

GM # AAA group server radius A – Group

# Server 10.10.10.10

GM # Username CISCO Secret CISCO

GM # AAA authentication login default group R – Group Local

Resources

CCNP

Switching (300-115)

45 | P a g e

CCNP

Switching (300-115)

46 | P a g e

table of contents - atnedu.lk · 2019-06-29 · gm # interface fastethernet 0/1 # switchport trunk...

Documents