Tuesday, February 9, 2016
Port Security
Port Security controls port access based on MAC addresses.
Max number of MAC addresses per port is 1024.
By default, port security learns MAC addresses dynamically and stores them in the CAM table and runnung configuration. If the switch reloads, port security will have to relearn a new set of MAC addresses. Use "sticky" to make the MAC addresses persistent across a switch reload.
switchport port-security violation {shutdown | restrict | protect}
Shutdown: Port is immediately put into errdisable mode. Must be reenabled manually / throuth errdisable recovery.
Restrict: Port is allowed to stay up, and all packets from the violating MAC address are dropped. Switch keeps record and can send an SNMP trap and Syslog message.
Protect: Port is allowed to stay up, and packets from the violating MAC addresses are dropped. No record is kept.
Spanning Tree
802.1D Overview
Spanning Tree Protocol (STP) provides network link redundancy so that a Layer 2 switched network can recover from failures without intervention in a timely manner.
Transparent Bridge - A network device that isolates two physical LANs but forwards ethernet frames between them. Frames forwarded across the bridge cannot be modified by the bridge itself. Therefore, the bridging process is effectively transparent.
Spanning Tree Communication: Bridge Protocol Data Units
Configuration BPDU, used for spanning-tree computation.
Topology Change Notification (TCN) BPDU, used to announce changes in the network topology.
BPDU Message Content
Protocol ID 2
Version 1
Message Type (Config / TCN) 1
Flags 1
Root Bridge ID 8
Root Path Cost 4
Sender Bridge ID 8
Port ID 2
Message Age 2
Maximum Age 2
Hello Time 2
Forward Delay 2
Electing a Root Bridge
Bridge ID is an 8-Byte value with the following fields:
Bridge Priority (2 bytes) Values: 0 - 65,535, and defaults to 32,768.
MAC Address (6 bytes) Hard coded unique value.
1.) Root bridge is elected.
Every switch begins by sending out BPDUs with a root bridge and sender bridge equal to its own bridge ID.
After the root bridge is elected, configuration BPDUs are sent out only by the Root Bridge. All other bridges must forward or relay the BPDUs, adding their own sender bridge IDs to the message.
Best bridge ID has the lowest value.
Root bridge election is an ongoing process, triggered by root bridge ID changes in the BPDUs every 2 seconds.
2.) Electing Root Ports
Each non-root switch must figure out where it is in relation to the root bridge. This is done by selecting only one non-root port for each non root switch. The root port always points to the current root bridge.
Calculate the root path cost to select the root port. This is the cumulative value of all links leading to the root bridge.
Only the root path cost is carried in the BPDU. As the root path cost travels along, other switches can modify it's value to make it cumulative. The path cost is local to the switch and not carried in the BPDU.
4 Mbps 250
10 Mbps 100
100 Mbps 19
1Gbps 4
10 Gbps 2
The root path cost is incremented by the ingress port path cost as the BPDU is received at each switch down the line.
3.) Electing Designated Ports
The final step in the election process. Elects one designated port on each network segment.
For each determination process, if two or more links have equal root path costs, other factors need to be considered to break up the tie.
1.) Lowest root bridge ID
2.) Lowest root path cost to root bridge
3.) Lowest sender bridge ID
4.) Lowest sender port ID
STP State The Port Can... The Port cannot... Duration
Disabled N/A Send or receive data N/A
Blocking Receive BPDUs Send or receive data or Indefinite as long as loop
learn MAC addresses has not been detected.
Listening Send and receive BPDUs Send or receive data or Fwd delay timer 15 secs
learn MAC addresses
Learning Send and receive BPDUs Send and receive data Fwd delay timer 15 secs
and learn MAC addresses
Forwarding Send and receive BPDUs,
Learn MAC addresses, Indefinite as long as port is
and send and receive data. up and loop is not detected.
STP Portfast feature on a port with a single attached PC. TCNs are not sent when the port changes state, the port is brought into the Forwarding state when the link comes up.
In 802.1Q. All CST BPDUs are transmitted over trunk links using the native VLAN with untagged frames.
PVST - Cisco Proprietary - Requires ISL.
PVST+ - Provides interoperability between CST and PVST - Both 802.1Q and ISL.
Root Port: The one port on a switch that is closest to the root bridge.
Designated Port: The port on a LAN segment that is closest to the root. Relays, or transmits, BPDUs down the tree.
Blocking Port: Neither root or designated.
Alternate Port: Candidates for root ports. Close to the root bridge and in blocking state.
Forwarding Ports: No other STP activity is detected or expected. Normal end user connections.
Root Guard
Means to control where candidate root bridges can be connected and found on a network. If it receives a superior BPDU, the port will be moved and kept in the root-inconsistent state until the superior BPDUs cease.
The switch can only forward or relay BPDUs; the port cannot be used to receive BPDUs.
When superior BPDUs are no longer received, the port is cycled through the normal STP states to return to normal use.
BPDU Guard
Developed to further protect the integrity of switch ports that have PortFast enabled. If any BPDU is received on a port, that port is immediately put into the errdisable state.
When the BPDUs no longer are received, the port still remains in the errdisable state.
Use BPDU Guard on all switch ports where STP PortFast is enabled.
If the absence of BPDUs is actually a mistake and BPDUs are not being received even though there is no topology change, bridging loops can form.
Loop Guard - When BPDUs go missing, Loop Guard moves the port into the loop-inconsistent state.
When BPDUs are received again, Loop Guard allows the port to move through the normal STP states and become active.
Blocks on a per-Vlan basis, so the the entire port is not blocked.
Loop Guard can be enabled on all switch ports.
UDLD -
A unidirectional link poses a potential danger to STP topologies because BPDUs will not be received on one end of the link. If that end of the link would normally be in the blocking state, it will not be that way for long.
Use the Cisco proprietary UDLD STP feature to prevent this.
Uses an echo process to determine if both sides are up or not. Both sides need to be configured.
UDLD can detect a unidirectional link after about three times the UDLD message interval (45 seconds total) using default. Needs to detect the link failure before STP moves it into forwarding state.
Can be enabled per port or globally for fiber optic switch ports.
Enabling UDLD globally does not affect copper media because it does not suffer from the conditions that allow a unidirectional link to form.
Once UDLD aggressive mode has put a switch port into errdisable state, you must use the following command to reenable it.
Switch# udld reset
Rapid Spanning Tree Protocol
By default, a switch operates in Per-VLAN Spanning Tree Plus (PVST+) mode using traditional 802.1D STP.
Root Port: The one root port that has the best root path cost. Identical to 802.1D
Designated Port: Best root path cost to the root.
Alternate Port: Alternate path to the root, different from the path the root port takes.
Backup Port: Redundant but less desirable connection to a segment where another switch port already connects.
Defines states only according to what the port does with incoming frames.
Discarding - Incoming frames are simply dropped. No MAC addresses learned. Combines 802.1D Disabled, Blocking, and Listening. (The Listening state is not needed because RSTP quickly can negotiate a state change without listening for BPDUs first).
Learning - Incoming frames are dropped, MAC addresses are learned.
Forwarding - Incoming frames are forwarded according according to their corresponding MAC addresses.
Edge Port - Port at the "edge of the network where only one host connects. Switch# spanning-tree portfast
Root Port - Port that has the best cost to the root of the STP instance. Only one root port, although alternative paths can exist on other ports.
Point-to-point port - Any port that connects to another switch and becomes a designated port. BPDUs are exchanged back and forth in the form of a proposal and agreement.
Spanning Tree Protocol (STP) provides network link redundancy so that a Layer 2 switched network can recover from failures without intervention in a timely manner.
Transparent Bridge - A network device that isolates two physical LANs but forwards ethernet frames between them. Frames forwarded across the bridge cannot be modified by the bridge itself. Therefore, the bridging process is effectively transparent.
Spanning Tree Communication: Bridge Protocol Data Units
Configuration BPDU, used for spanning-tree computation.
Topology Change Notification (TCN) BPDU, used to announce changes in the network topology.
BPDU Message Content
Protocol ID 2
Version 1
Message Type (Config / TCN) 1
Flags 1
Root Bridge ID 8
Root Path Cost 4
Sender Bridge ID 8
Port ID 2
Message Age 2
Maximum Age 2
Hello Time 2
Forward Delay 2
Electing a Root Bridge
Bridge ID is an 8-Byte value with the following fields:
Bridge Priority (2 bytes) Values: 0 - 65,535, and defaults to 32,768.
MAC Address (6 bytes) Hard coded unique value.
1.) Root bridge is elected.
Every switch begins by sending out BPDUs with a root bridge and sender bridge equal to its own bridge ID.
After the root bridge is elected, configuration BPDUs are sent out only by the Root Bridge. All other bridges must forward or relay the BPDUs, adding their own sender bridge IDs to the message.
Best bridge ID has the lowest value.
Root bridge election is an ongoing process, triggered by root bridge ID changes in the BPDUs every 2 seconds.
2.) Electing Root Ports
Each non-root switch must figure out where it is in relation to the root bridge. This is done by selecting only one non-root port for each non root switch. The root port always points to the current root bridge.
Calculate the root path cost to select the root port. This is the cumulative value of all links leading to the root bridge.
Only the root path cost is carried in the BPDU. As the root path cost travels along, other switches can modify it's value to make it cumulative. The path cost is local to the switch and not carried in the BPDU.
4 Mbps 250
10 Mbps 100
100 Mbps 19
1Gbps 4
10 Gbps 2
The root path cost is incremented by the ingress port path cost as the BPDU is received at each switch down the line.
3.) Electing Designated Ports
The final step in the election process. Elects one designated port on each network segment.
For each determination process, if two or more links have equal root path costs, other factors need to be considered to break up the tie.
1.) Lowest root bridge ID
2.) Lowest root path cost to root bridge
3.) Lowest sender bridge ID
4.) Lowest sender port ID
STP State The Port Can... The Port cannot... Duration
Disabled N/A Send or receive data N/A
Blocking Receive BPDUs Send or receive data or Indefinite as long as loop
learn MAC addresses has not been detected.
Listening Send and receive BPDUs Send or receive data or Fwd delay timer 15 secs
learn MAC addresses
Learning Send and receive BPDUs Send and receive data Fwd delay timer 15 secs
and learn MAC addresses
Forwarding Send and receive BPDUs,
Learn MAC addresses, Indefinite as long as port is
and send and receive data. up and loop is not detected.
STP Portfast feature on a port with a single attached PC. TCNs are not sent when the port changes state, the port is brought into the Forwarding state when the link comes up.
In 802.1Q. All CST BPDUs are transmitted over trunk links using the native VLAN with untagged frames.
PVST - Cisco Proprietary - Requires ISL.
PVST+ - Provides interoperability between CST and PVST - Both 802.1Q and ISL.
Root Port: The one port on a switch that is closest to the root bridge.
Designated Port: The port on a LAN segment that is closest to the root. Relays, or transmits, BPDUs down the tree.
Blocking Port: Neither root or designated.
Alternate Port: Candidates for root ports. Close to the root bridge and in blocking state.
Forwarding Ports: No other STP activity is detected or expected. Normal end user connections.
Root Guard
Means to control where candidate root bridges can be connected and found on a network. If it receives a superior BPDU, the port will be moved and kept in the root-inconsistent state until the superior BPDUs cease.
The switch can only forward or relay BPDUs; the port cannot be used to receive BPDUs.
When superior BPDUs are no longer received, the port is cycled through the normal STP states to return to normal use.
BPDU Guard
Developed to further protect the integrity of switch ports that have PortFast enabled. If any BPDU is received on a port, that port is immediately put into the errdisable state.
When the BPDUs no longer are received, the port still remains in the errdisable state.
Use BPDU Guard on all switch ports where STP PortFast is enabled.
If the absence of BPDUs is actually a mistake and BPDUs are not being received even though there is no topology change, bridging loops can form.
Loop Guard - When BPDUs go missing, Loop Guard moves the port into the loop-inconsistent state.
When BPDUs are received again, Loop Guard allows the port to move through the normal STP states and become active.
Blocks on a per-Vlan basis, so the the entire port is not blocked.
Loop Guard can be enabled on all switch ports.
UDLD -
A unidirectional link poses a potential danger to STP topologies because BPDUs will not be received on one end of the link. If that end of the link would normally be in the blocking state, it will not be that way for long.
Use the Cisco proprietary UDLD STP feature to prevent this.
Uses an echo process to determine if both sides are up or not. Both sides need to be configured.
UDLD can detect a unidirectional link after about three times the UDLD message interval (45 seconds total) using default. Needs to detect the link failure before STP moves it into forwarding state.
Can be enabled per port or globally for fiber optic switch ports.
Enabling UDLD globally does not affect copper media because it does not suffer from the conditions that allow a unidirectional link to form.
Once UDLD aggressive mode has put a switch port into errdisable state, you must use the following command to reenable it.
Switch# udld reset
Rapid Spanning Tree Protocol
By default, a switch operates in Per-VLAN Spanning Tree Plus (PVST+) mode using traditional 802.1D STP.
Root Port: The one root port that has the best root path cost. Identical to 802.1D
Designated Port: Best root path cost to the root.
Alternate Port: Alternate path to the root, different from the path the root port takes.
Backup Port: Redundant but less desirable connection to a segment where another switch port already connects.
Defines states only according to what the port does with incoming frames.
Discarding - Incoming frames are simply dropped. No MAC addresses learned. Combines 802.1D Disabled, Blocking, and Listening. (The Listening state is not needed because RSTP quickly can negotiate a state change without listening for BPDUs first).
Learning - Incoming frames are dropped, MAC addresses are learned.
Forwarding - Incoming frames are forwarded according according to their corresponding MAC addresses.
Edge Port - Port at the "edge of the network where only one host connects. Switch# spanning-tree portfast
Root Port - Port that has the best cost to the root of the STP instance. Only one root port, although alternative paths can exist on other ports.
Point-to-point port - Any port that connects to another switch and becomes a designated port. BPDUs are exchanged back and forth in the form of a proposal and agreement.
Stacking and VSS
StackWise/StackWise Plus enable separate physical switches to act as a single logical switch.
Cisco Catalyst 3750-E, 3750-X, and 3850 platforms.
Virtual Switching System (VSS)
Cisco Catalyst 4500R, 6500, and 8500.
VSS - configure two identical chassis to act as one logical switch.
One supervisor in one of the chassis controls the operation of the logical switch. If it fails, the supervisor in the other chassis takes over.
The chassis must be linked together by multiple interfaces that have been configured as a virtual switch link (VSL).
Route Processor Redundancy (RPR) - The redundant supervisor is only partially booted and initialized. To become ative, the Standby module must reload every module in the switch and initialize all supervisor functions.
Route Processor Redundancy Plus (RPR+) - The redundant supervisor is booted, allowing the supervisor and route engine to initialize. No L2/L3 functions are started. To become active, the Standby module finishes initializing without reloading other switch modules.
Stateful Switchover (SSO) - The redundant supervisor is fully booted and initialized. Startup and running configurations are are synchronized between the supervisor models. L2 information is maintained on both supervisors so that hardware switching can continue during a failover.
Single Server Mode (SRM) - Two route processors are being used, but one is active.
Dual Router Mode (DRM) - Two route processors are active at all times. HSRP is used to provide redundancy in DRM.
SRM is not compatible with RPR and RPR+, because the route processor portion is not initialized by the standby unit.
SRM is inherent with SSO, witch brings up the standby processor.
Subscribe to:
Posts (Atom)