Welcome to Mat's Cloud

VTP - Should we use it?

VLAN Trunking Protocol: most commands can be configured in PRIVILEGED, CONFIGURE or DATABASE mode

- Have in mind that there is no way to dis-configure the VTP DOMAIN NAME (by default its NULL). You have to delete flash:vlan.dat and erase the Startup config and reload the router

VTP messages source IP (the IP from which the VTP messages are sourced):
(config)#vtp interface Loopback 1 [only] <- It will not be propagated

Restrict FLOOD TRAFFIC to the TRUNK Interfaces - use VTP PRUNING>
There are 4 types of VTP Advertisments exchanged between the switches:
1. Summary Advertisments - every time VTP database changes (every 300 ms)
2. Subset Advertisments - sent right after SUMMARY, includes what exactly changed
3. Advertisments requested from clients - client requests info to update the VTP database, server responds
4. VTP Membership announcements - when PRUNING is enabled, they tell the neighbor WHAT VLANs they want (if the VLAN is not announced with this message, it is not on the trunk)

Check the PRUNING STATUS:
#show interfaces pruning
Pruning not currently enabled in this device's VTP administrative domain.

ENABLE PRUNING>
#vtp pruning <--- PROPAGATED TO ALL SWITCHES WITHIN THE VTP DOMAIN
Pruning switched on

*VLAN 1 CANNOT BE PRUNED!!!
**VLANs that are used locally also CANNOT BE PRUNED

Spanning Tree: Root Election and Path Tuning

The concept is rather simple - The Switches send these probes called the BPDUs (Bridge Protocol Data Units) to discover loops in the network. If the BPDU “returns” – there is a loop in the network!

BPDU = 4-bit-PRIORITY + MAC Address

Spanning tree is no game, so be extremely careful when tuning the Priorities, Costs and Port-Priorities in order to manually make the Switch set your desired path as preferred. Each problem and mis-configuration can easily cause a major critical situation, as most of the Layer2 Loop Problems cause your Switches to immediately increase the CPU usage drastically. For your own stress-free dreams be sure to test in the Pre-Production environment everything you need to change in your production network regarding the Spanning Tree.

I´m not going to get into the explaining the Spanning Tree basics here, as I guess most of the CCIE candidates should be familiar with it. The focus of this post will be the pure control of the Root Bridge in your network, and the preferred links.

Set the Root Bridge

There are two ways to set which Switch within your network will take the roll or the Root Bridge. They are both based on setting the priority parameter, and therefore the Bridge ID.

BRIDGE ID = PRIORITY* + VLAN No + MAC Address

*PRIORITY = N x 4096 (values between 0 and 61440, with 32768 being the mid-value chosen as a "default priority")

Remember about the STP: LOWER PRIORITY IS BETTER!!!

1^st Way of setting the PRIORITY – SET PRIMARY/SECONDARY

(config)# spanning-tree vlan 1 root [primary | secondary]

Honestly I don’t like this way because theres a general confusion among the network engineers that this command somehow dynamically sets the Switch to maintain its role as a Root Bridge. It doesn’t!!! It just sets the priority value to the lower value that the CURRENT Root Bridge has (case of primary), or sets the FIXED value to the 28672 (case of secondary).

2^nd way of setting the PRIORITY – Manual priority command

(config)# spanning-tree vlan 1 priority X*

*X = N x 4096 (values between 0 and 32768)

Personally I prefer this way, makes me that I´ve got much more control over the L2 network when I set the parameters myself, no automatic stuff and elections!

Be extremely careful when manually adjusting this parameter as it will totally alter your Layer 2 Switching Paths. What basically happens here is that each switch in the network does the following process:

1. Determine who the Root Bridge is

2. Find the shortest path to the Root Bridge looking at the COST parameter

1. Block all the other paths*

*In the basic version of the Per-VLAN Spanning Tree Protocol, 802.1D the ports have one of the following states:

- ROOT Port – Used to reach the Root Bridge (Port TOWARDS the Root Bridge)

- DESIGNATED Port – Forwarding Port (One-Per-Link, Port AWAY from the Root Bridge)

- BLOCKING (Non-DESIGNATED) Port – the link where “the tree fell”

On the NEWER versions of this protocol, such as Rapid STP (802.1w) two new port roles are introduced instead of the BLOCKING port:

- - ALTERNATE Port – The improvement where the Switch actually “remembers” its alternative path to reach the Root Bridge in order to failover immediately in case the primary link goes down

- - EDGE Port – towards the NON-SWITCH devices, has portfast feature configured

Link Cost

You´ve already chosen the Root Bridge, everything is fine, but for some reason – you don’t want your traffic to prefer a certain link… Why? Well, maybe you´ve got insider information that the cable is bad, that the cleaning lady sometimes unplugs it by accident, or… well, or you simply consider it better for your design. Cisco allows you to manually set the COST of one link to a higher value so that the other link is chosen as the preferred, and that way you gain the control of the Root Port election on your switch.

This is a GNS3 diagram of 3 Switches, and it will serve for this example. Lets say SW3 is the Root Bridge, and all the links are 100Mbps, which would be the COST of 19. Naturally the SW1 chooses the direct link towards the SW3 cause it costs him 19 to get there.

Lets sat that for some reason we want to force the SW1 to use the other path to reach the SW3 (the link SW1-SW2-SW3). The cost of that link is 38, so what do we do? We set the cost of the direct link SW1-SW3 to the value greater than 38. Let’s go with the value of 39:

(config-if)# spanning-tree vlan 1 cost 39

*Notice that the configuration is done on the Interface level

Port Priority

This command is used only when there are more ways to reach the SAME SWITCH. Sometimes it’s a tie-breaker so be careful, it determines which ports are in the FWD and which in the BLK state. The default port priority is 128, so you need to define the lower value in order for the link to be preferred. The value range is between 0 and 255.

Check the output of the *show spanning tree interface x details* command on the Cat2 device:

Cat1(config-if)#spanning-tree vlan 1 port-priority 64
Cat2#show spanning-tree vlan 1 int fa0/24 detail Port 24 (FastEthernet0/24) of VLAN0001 is root forwarding Port path cost 19, Port priority 128, Port Identifier 128.24. Designated root has priority 24577, address 0018.1820.2700 Designated bridge has priority 24577, address 0018.1820.2700 Designated port id is 64.26, designated path cost 0 Timers: message age 2, forward delay 0, hold 0 Number of transitions to forwarding state: 2 Link type is point-to-point by default BPDU: sent 1993, received 697

The important thing is that the UPSREAM value needs to be changed because it’s the RECEIVED port priority that really matters! For the port to be preferred we need to set a smaller value on the Cat1 device, so let’s go with 64:

And when we check the output of the *show spanning tree interface x details* command again:

Cat2#show spanning-tree vlan 1 interface fa0/24 details
Port 24 (FastEthernet0/24) of VLAN0001 is alternate blocking
Port path cost 19, Port priority 128, Port Identifier 128.24.
Designated root has priority 24577, address 0018.1820.2700
Designated bridge has priority 24577, address 0018.1820.2700
Designated port id is 128.26, designated path cost 0
Timers: message age 1, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is point-to-point by default
BPDU: sent 1992, received 306

For more details please check the Cisco official Spanning Tree Configuration reference: Cisco Configuration Guide

Dot1q Tunneling: 802.1q, QinQ Tunneling

When a TUNNEL port receives Customers Traffic - INGRESS PORT adds 2 Byte EtherType field 0x8100 + 2 Bytes for CoS and VLAN
Eggress tunnel port STRIPS THESE 4 BYTES
(config-if)#switchport access vlan 100
(config-if)#switchport mode dot1q-tunnel

You can also configure L2 TUNNELING (CDP, STP and VTP can be tunneled)
(config-if)#l2protocol-tunnel [cdp | stp | vtp]

#show l2protocol-tunnel summary

*Take SPECIAL CARE about the MTU SIZE on Swithches (might need to increase to 1504 due to the ADDED 4 BYTES IN THE TUNNEL)

CONTROL Plane Policy

CBAC and Zone Based FW are all DATA Plane policies. Another type of Security Policies is a Control Plane Policy. This is quite similar to Cisco's MQC used for the QoS traffic shaping and policing. You can also use the commands like from MQC to limit (POLICE) the Control Traffic.

You can use STANDARD CLASS-MAPS like in MQC to match PROTOCOL or ACLs (access-group), but you can also use, example, the LOGGING TYPE CLASS-MAPS:
(config)#class-map type logging match-any LOGGING
(config-cmap)#match packets ?
dropped Packets dropped by control-plane protection features <-IN ORDER TO VIEW THE CONTROL PLANE
error Error packets dropped by control-plane protection features
permitted Packets permitted by control-plane protection features

(config)#policy-map POLICE_50KBPS
(config-pmap)#class CONTROL_BW
(config-pmap-c)#police 50000 conform-action transmit exceed-action drop violate-action drop

The trick is to APPLY the Policy Map to the CONTROL PLANE:
(config)#control-plane
(config-cp)#service-policy input POLICE_50KBPS

BANNER and MENU Configuration

If you need to define a BANNNER to display the user restrictions, have in mind that you can use the variables:
$(hostname) $(line) $(domain)

You also have an option of creating the DYNAMIC ENTRIES as a banner, and let user use the VARIABLES as a response:
Cisco Docs: Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.4T>Banner Configuration

Step 1: Define the MENU TITLE
(config)#menu MYMENU title & This is the AXA menu

Step 2: Define the TEXT ITEMS:
(config)#meny MYMENU text 1 Display all interfaces with their IPs
(config)#meny MYMENU text 2 Display the configuration of Fa1/0/1
(config)#meny MYMENU text 3 Logout
(config)#meny MYMENU text 4 Exit the Menu

Step 3: Specify the UNDERLYING COMMAND of each item in the MENU:
(config)#menu MYMENU command 1 sh ip int br
(config)#menu MYMENU command 2 sh run int fa1/0/1
(config)#menu MYMENU command 9 sh menu-exit

Step 4: Define the DEFAULT action:
(config)#menu MYMENU default 9

Step 5: Define the GLOBAL commands, for example to clean the screen when the MENU starts:
(config)#menu MYMENU clear-screen

Etherchannel L2 vs L3

PAgP (Port Aggregation Protocol) - Cisco Prop. DESIRABLE or AUTO or NONEGOTIATE
*in case the link is configured as ACCESS, or the "switchport nonegotiate" command
- Protocol Value: 0x0104
- Same multicast group MAC like CDP

LACP (Link Aggregation Control Protocol) - 802.3ad - ACTIVE or PASSIVE
- Multicast MAC: 01-80-C2-00-00-02
- During Detection transmits packets every second

LACP>
Check the DEFAULT PARAMETERS:
2#show lacp 1 internal
Flags: S - Device is requesting Slow LACPDUs
F - Device is requesting Fast LACPDUs
A - Device is in Active mode P - Device is in Passive mode

Channel group 1
LACP port Admin Oper Port Port
Port Flags State Priority Key Key Number State
Gi3/0/19 SA bndl 32768 0x1 0x1 0x7F 0x3D
Gi3/0/20 SA bndl 32768 0x1 0x1 0x80 0x3D

"ON" - Doesnt use LACP or PaGP. BOTH sides MUST BE ON!!!
#do show etherch protocol
Channel-group listing:
----------------------

Group: 13
----------
Protocol: - (Mode ON)

You can configure MAX 16 PORTS, out of which:
MAXIMUM 8 ACTIVE PORTS, and the other HOT STANDBY (activate if one of the first 8 fail). Which ones belong to
the ACTIVE group depends on the LACP PRIORITY, that can be configured:
(config-if)#lacp port-priority 1 <--- LOWER IS BETTER!!! (default is 32768)

L3 ETHERCHANNEL: Configure the Port-Channel interface statically, and all L3 configuration under it
Summary: 32 Po32(RU) - Gi1/0/23(P) Gi1/0/24(P)

L2 ETHERCHANNEL: LOGICAL INTERFACE CREATED AUTOMATICALLY. Best Practice (CONFIGURATION):
- Default Interface
- Channel Protocol and Group on physical interface (this creates Port Channel)
- Configure TRUNKING ENCAPSULATION under the PORT CHANNEL directly
- SHUT -> NO SHUT on PHYSICAL INTERFACES
Summary: 24 Po24(SU) PAgP Gi1/0/21(P) Gi1/0/22(P)

* "show interface trunk" Will show only Port Channel, but "show interface XX switchport" will show that the INT IS TRUNK

LOAD BALANCE the Etherchannel>
*CONFIGURED in the Global Config mode:
(config)#port-channel load-balance ?
dst-ip Dst IP Addr
dst-mac Dst Mac Addr
src-dst-ip Src XOR Dst IP Addr
src-dst-mac Src XOR Dst Mac Addr
src-ip Src IP Addr
src-mac Src Mac Addr

#show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
dst-mac

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Destination MAC address
IPv4: Destination MAC address
IPv6: Destination MAC address

Router Security - Best Practices

First you should define some RULES for the password definitions. For example - Minimal Password Lenght:
(config)#security passwords min-length 7

Permit users to have to wait for 1 minute if they attempt to log in for 3 times, and LOG it:
(config)#login block-for 60 attempts 3 within 60 <- ALLOW 3 ATTEMPTS WITHIN 1 MINUTE
(config)#security authentication failure rate 3 log <- LOG FAILED ATTEMPTS

To set up a PRIVILEGE mode password, that used an MD5 hashing:
(config)#enable secret level 15 0 Cisco07
*TIP: If your password contains "?", you need to press "ESC+Q" before you enter the "?" sign.

To define the USERNAME and assign it a MD5 Hash Password:
(config)#username cisqueros secret 0 Cisco07
(config)#do sh run | i username
username cisqueros secret 5 $1$YyRE$V60bOcwZ7ZK0LMusIVnhs/

No Service Password-Recovery feature is a security enhancement to prevent anyone with console access from accessing the router configuration and clearing the password. If you want to do this, make sure the Conf.Register is 0x2102:
#sh ver | i register
Configuration register 0x2102 (Ignores break, Boots into ROM if initial boot fails, 9600 console baud rate default)
More about Configuration Register Values:
http://www.cisco.com/en/US/products/hw/routers/ps133/products_tech_note09186a008022493f.shtml

The apply the command. *This command is HIDDEN, so the "?" will not display it! You will also be WARNED by IOS:
(config)#no service password-recovery
WARNING: Executing this command will disable password recovery mechanism.
Do not execute this command without another plan for password recovery.
Are you sure you want to continue? [yes/no]:

!!!Don´t forget to configure both - CONSOLE Port (line con 0) and AUXILIARY Port as a backup solution (line aux 0)
You should automatically DISCONNECT these sessions (CON & AUX) after some time of inactivity:
(config-line)#session-timeout 300 <-DISCONNECT IF NO INPUT FOR 5 MINUTES
(config-line)#exit-timeout 300 <-TERMINATE CONSOLE CONNECTION IF NO INPUT FOR 5 MINUTES

If you have more then one administrator, and you want to limit them to a certain commands, use "privilege EXEC", and define the Privilege Level 9 commands:
(config)#privilege exec level 9 show interfaces <- BOTH "SHOW" AND "SHOW INT" WILL APPEAR IN "SHOW RUN"
(config)#privilege exec level 9 ping
(config)#privilege exec level 9 traceroute

Be sure to apply the usage of the local user database on the CONSOLE PORT:
(config)#line con 0
(config-line)#login local

To disable showing WHO IS CURRENTLU LOGGED INTO the device:
(config)#no ip finger

Most Popular Posts