HNT: VLAN

Showing posts with label VLAN. Show all posts

30 July, 2014

Private VLAN

VLANs involved:
- Primary
- Secondary

Secondary VLAN Types:
- Isolated
- Community

Port Types:
- Promiscuous
- Isolated
- Community

! Private VLANs require Transparent Mode VTP
SW2(config)#vtp mode transparent

! Create the Community secondary VLANs
SW2(config)#vlan 500
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#exit
SW2(config)#vlan 400
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#exit
SW2(config)#vlan 400
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#exit

! Create the Isolated secondary VLAN
SW2(config)#vlan 200
SW2(config-vlan)#private-vlan isolated
SW2(config-vlan)#exit

! Create the Primary VLAN
SW2(config)#vlan 100
SW2(config-vlan)#private-vlan primary

! Associate all the secondary VLANs to this Primary VLAN
SW2(config-vlan)#private-vlan association 200,300,400,500
SW2(config-vlan)#exit

! Specify the Promiscuous port
SW2(config)#interface fas 0/11
SW2(config-if)#switchport mode private-vlan promiscuous

! Specify the Primary VLAN #, followed by the Secondaries
SW2(config-if)#switchport private-vlan mapping 100 200,300,400,500
SW2(config-if)#exit

! Place a couple interfaces in the Isolated VLAN
SW2(config)#interface range fas 0/12-13
SW2(config-if)#switchport mode private-vlan host

! List the Primary VLAN then Secondary (Isolated) VLAN
SW2(config-if)#switchport private-vlan host-association 100 200

! Add a port to Community VLAN 300
SW2(config)#interface fas 0/14
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan host-association 100 300

! Add a port to Community VLAN 400
SW2(config)#interface fas 0/15
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan host-association 100 400

! To Verify use:
SW2#show vlan private vlan
SW2#show int fas 0/11 switchport

14 February, 2014

VLAN Troubleshooting

Cisco R&S Troubleshooting Mastery

### VLAN Troubleshooting

! How we can create Vlans

#Use coma
SW1(config)#vlan 111,112,113
SW1(config-vlan)#exit
SW1(config)#do show vlan brief | in VLAN011
111 VLAN0111 active
112 VLAN0112 active
113 VLAN0113 active

#Use range
SW1(config)#vlan 111-117,119
SW1(config-vlan)#exit
SW1(config)#do show vlan brief | in VLAN011
111 VLAN0111 active
112 VLAN0112 active
113 VLAN0113 active
114 VLAN0114 active
115 VLAN0115 active
116 VLAN0116 active
117 VLAN0117 active
119 VLAN0119 active

# T-Shoot VLAN Config

! We have 2 pc connected into (VLAN 100) Fa0/3 and Fa0/4 in same subnet but Ping doesn´t work.

SW1#show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9
Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15
Fa0/16, Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21
Fa0/22, Gi0/1, Gi0/2
100 VLAN0100 act/unsup Fa0/4
<Omitted Lines>

! Port Fa0/3 is missing
! Could fa0/3 be a trunk ?

SW1#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/23 on 802.1q trunking 1
Fa0/24 on 802.1q trunking 1
<Omitted Lines>

SW1#show interfaces fa0/3 trunk
Port Mode Encapsulation Status Native vlan
Fa0/3 off negotiate other 1
<Omitted Lines>

! No Trunks. Lets look at fa0/3

SW1#show interfaces fastEthernet 0/3
FastEthernet0/3 is up, line protocol is down (monitoring)
Hardware is Fast Ethernet, address is 0017.956e.fa03 (bia 0017.956e.fa03)
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100BaseTX
<Omitted Lines>

! It is a monitoring port.
! Monitoring means that this port is configured as destination port for SPAN.

SW1#show monitor
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa0/4
Destination Ports : Fa0/3
Encapsulation : Native
Ingress : Disabled

! Disable the monitor configuration

SW1(config)#no monitor ses 1

! Now lets take a look again

SW1#show interfaces status | in Fa0/3
Port Name Status Vlan Duplex Speed Type
Fa0/3 Connected 100 auto auto 10/100BaseTX

! But Ping not still works!

SW1#show vlan id 100
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
100 VLAN0100 act/unsup Fa0/3, Fa0/4, Fa0/23, Fa0/24

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
100 fdnet 100100 1500 - - - - - 0 0
<Omitted Lines>

! Now we can see that Status is "unsupported" because Media type says "fdnet".
! We need to change media type for vlan 100

SW1(config)#vlan 100
SW1(config-vlan)#media ?
ethernet VLAN type Ethernet
fd-net VLAN type FDDI Net
fddi VLAN type FDDI
trbrf VLAN type TRBRF
trcrf VLAN type TRCRF

SW1(config-vlan)#media ethernet
SW1(config-vlan)#end

SW1#show vlan id 100
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
100 VLAN0100 act/lshut Fa0/3, Fa0/4, Fa0/23, Fa0/24

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
100 enet 100100 1500 - - - - - 0 0

! But Ping don´t works yet.

! We can see that the status is "lshut" it´s don´t loog good.
! This status means that someone has shutdown vlan 100.

SW1(config)#vlan 100
SW1(config-vlan)#no shutdown
SW1(config-vlan)#end

SW1#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2
100 VLAN0100 active Fa0/3, Fa0/4

! Finally Ping is Working !!!

07 January, 2014

Cisco CCNP Switch Chapter 17

Setting Up Private VLANs

#Change VTP mode to Transparent
SW1#conf terminal
SW1(config)#vtp mode transparent

#Create Primary VLAN
SW1(config)#vlan 200
SW1(config-vlan)#private-vlan ?
association Configure association between private VLANs
community Configure the VLAN as a community private VLAN
isolated Configure the VLAN as an isolated private VLAN
primary Configure the VLAN as a primary private VLAN
SW1(config-vlan)#private-vlan primary
SW1(config-vlan)#exit

#Create Community VLAN
SW1(config)#vlan 205
SW1(config-vlan)#private-vlan community
SW1(config-vlan)#exit

#Create Isolated VLAN
SW1(config)#vlan 210
SW1(config-vlan)#private-vlan isolated
SW1(config-vlan)#exit

#Associate sub vlans to primary vlan
SW1(config)#vlan 200
SW1(config-vlan)#private-vlan association 205,210
SW1(config-vlan)#end

#Check created Vlans
SW1#show vlan private-vlan type
Vlan Type
---- -----------------
200 primary
205 community
210 isolated

#Port Configuration and associate Ports to Vlan

#Community Port Configuration
SW1#conf terminal
SW1(config)#interface Fa4/24
SW1(config-if)#switchport mode private-vlan ?
host Set the mode to private-vlan host
promiscuous Set the mode to private-vlan promiscuous

SW1(config-if)#switchport mode private-vlan host

SW1(config-if)#switchport private-vlan ?
association Set the private VLAN association
host-association Set the private VLAN host association
mapping Set the private VLAN promiscuous mapping

SW1(config-if)#switchport private-vlan host-association ?
<1006-4094> Primary extended range VLAN ID of the private VLAN host port
association
<2-1001> Primary normal range VLAN ID of the private VLAN port
association

SW1(config-if)#switchport private-vlan host-association 200 ?
<1006-4094> Secondary extended range VLAN ID of the private VLAN host port
association
<2-1001> Secondary normal range VLAN ID of the private VLAN host port
association

SW1(config-if)#switchport private-vlan host-association 200 205
SW1(config-if)#interface Fa4/25
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 200 205

#Isolated Port Configuration
SW1(config)#interface Fa4/26
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 200 210

#Promiscuous Port Configuration
SW1(config-if)#interface Fa4/27
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan ?
association Set the private VLAN association
host-association Set the private VLAN host association
mapping Set the private VLAN promiscuous mapping

SW1(config-if)#switchport private-vlan mapping ?
<1006-4094> Primary extended range VLAN ID of the private VLAN promiscuous
port mapping
<2-1001> Primary normal range VLAN ID of the private VLAN promiscuous
port mapping
SW1(config-if)#switchport private-vlan mapping 200 ?
WORD Secondary VLAN IDs of the private VLAN promiscuous port mapping
add Add a VLAN to private VLAN list
remove Remove a VLAN from private VLAN list

SW1(config-if)#switchport private-vlan mapping 200 205,210

#Check Configuration
SW1#show vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
200 205 community Fa4/24, Fa4/25, Fa4/27
200 210 isolated Fa4/26, Fa4/27

SW1#show running-config
!
vtp mode transparent
!
vlan 200
private-vlan primary
private-vlan association 205,210
!
vlan 205
private-vlan community
!
vlan 210
private-vlan isolated
!
interface FastEthernet4/24
switchport private-vlan host-association 200 205
switchport mode private-vlan host
!
interface FastEthernet4/25
switchport private-vlan host-association 200 205
switchport mode private-vlan host
!
interface FastEthernet4/26
switchport private-vlan host-association 200 210
switchport mode private-vlan host
!
interface FastEthernet4/27
switchport private-vlan mapping 200 205,210
switchport mode private-vlan promiscuous
!

10 December, 2013

Cisco CCNP Switch Chapter 8

# Root Bridge Configuration
* Configure one switch as a root bridge in a determined fashion.
* Configure another switch as a secondary root bridge, in case of primary root bridge failure.

ASw1(config)#spanning-tree extend system-id (Priority + 12 bit VLAN ID)

# Manually setting the bridge priority value
ASw1(config)#spanning-tree vlan 10 priority <0-61440>

*Note: Bridge priority in increments of 4096 (Lower is prefered)
* If STP extended system ID is enabled, the default bridge-priority is 32,768 plus the VLAN number

# Primary and Secondary Configurations
ASw1(config)#spanning-tree vlan 10 root [ primary | secondary ]

#Change an interface's per VLAN spanning tree path cost
ASw1(config-if)#spanning-tree vlan 10 cost <1-200000000>
ASw1(config-if)#spanning-tree cost <1-200000000>

*Note: If the vlan parameter is given, the port cost is modified only for the specified VLAN.

#Displaying STP Port Cost Values
ASw1#show spanning-tree interface fastEthernet 0/7 cost
VLAN0001 19
VLAN0006 19
VLAN0010 19
VLAN0100 19
VLAN0101 19

#Displaying STP Port Cost Values of the VLANs
ASw1#show spanning-tree interface fastEthernet 0/7
Vlan Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
VLAN0001 Root FWD 19 128.8 P2p
VLAN0006 Root FWD 19 128.8 P2p
VLAN0010 Root FWD 19 128.8 P2p
VLAN0100 Root FWD 19 128.8 P2p
VLAN0101 Root FWD 19 128.8 P2p

#Configuring STP Port Priority
ASw1(config-if)#spanning-tree port-priority <0-240> (By Default is 128)

*Note: port priority in increments of 16
Ej:
ASw1(config-if)#spanning-tree vlan 10,101 port-priority 64

#Modifying STP Timers

#Number of seconds between generation of config BPDUs
ASw1(config)#spanning-tree vlan 10 hello-time <1-10>

#Maximum number of seconds the information in a BPDU is valid
ASw1(config)#spanning-tree vlan 10 max-age <6-40>

#Number of seconds for the forward delay timer
ASw1(config)#spanning-tree vlan 10 forward-time <4-30>

#Redundant Link Convergence
* PortFast - Enables fast connectivity to be established on access-layer switch ports to workstations that are booting.
* UplinkFast - Enables fast-uplink failover on an access-layer switch when dual up-links are connected into the distribution layer.
* BackboneFast - Enables fast convergence in the network backbone or core layer switches after a spanning-tree topology change occurs.

#PortFast
*Note:
*Port Fast Shortens the Listening and Learning states
*When a workstation link comes up, the switch imedietly moves the PortFast port into Forwarding state. Spanning-Tree loop detection
is still in operation, however, and the port moves into Blocking state if a loop is ever detected on the port.
* By default PortFast is disabled on all switch ports.

# Configure PortFast By Default
ASw1(config)#spanning-tree portfast default

# configure PortFast on specific switch port
ASw1(config-if)#spanning-tree portfast

*Note: One other benefits of PortFast is that Topology Change Notification (TCN)

#UplinkFast
* If the primary uplink went down, up to 50 seconds could elapse before the redundant uplink could be used.
* With UplinkFast feature, when the primary root port uplink fails, another blocked uplink immediately can be brought up for use.

ASw1(config)#spanning-tree uplinkfast
ASw1(config)#spanning-tree uplinkfast max-update-rate <0-65535>

*Note:
*The command is not allowed on the root bridge Switch
*Range 0 to 65,535 pps (Packets Per Second)

ASw1#show spanning-tree uplinkfast
UplinkFast is enabled
Station update rate set to 150 packets/sec.
UplinkFast statistics
-----------------------
Number of transitions via uplinkFast (all VLANs) : 2
Number of proxy multicast addresses transmitted (all VLANs) : 0
Name Interface List
-------------------- ------------------------------------
VLAN1 Fa1/14(fwd), Fa1/15

#BackboneFast
* BackboneFast is simple to configure and operates by short-circuiting the Max-Age timerwhen needed.
* BackboneFast shortens the time a switch waits to detect a root path failure, ports still must go through full-length
Forward Delay timer intervals during the Listening and Learning states.

ASw1(config)#spanning-tree backbonefast

ASw1#show spanning-tree backbonefast
BackboneFast is enabled
BackboneFast statistics
-----------------------
Number of transition via backboneFast (all VLANs) : 0
Number of inferior BPDUs received (all VLANs) : 0
Number of RLQ request PDUs received (all VLANs) : 0
Number of RLQ response PDUs received (all VLANs) : 0
Number of RLQ request PDUs sent (all VLANs) : 0
Number of RLQ response PDUs sent (all VLANs) : 0

*Note: RLQ (Root Link Query)

ASw1#show spanning-tree brief
VLAN1
Spanning tree enabled protocol ieee
Root ID Priority 32768
Address c200.11dc.0000
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32768
Address c200.11dc.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300
Interface Designated
Name Port ID Prio Cost Sts Cost Bridge ID Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet1/14 128.55 128 19 FWD 0 32768 c200.11dc.0000 128.55
FastEthernet1/15 128.56 128 19 FWD 0 32768 c200.11dc.0000 128.56

#Verify STP
DSw1#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol ieee
Root ID Priority 10
Address 001d.45a8.4080
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 10 (priority 0 sys-id-ext 10)
Address 001d.45a8.4080
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.3 P2p
Fa0/2 Desg FWD 19 128.4 P2p
Fa0/3 Desg FWD 19 128.5 P2p
Fa0/4 Desg FWD 19 128.6 P2p
Fa0/24 Desg FWD 19 128.26 P2p

DSw1#show spanning-tree vlan 102
VLAN0102
Spanning tree enabled protocol ieee
Root ID Priority 102
Address 001d.a209.9980
Cost 19
Port 26 (FastEthernet0/24)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4198 (priority 4096 sys-id-ext 102)
Address 001d.45a8.4080
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.3 P2p
Fa0/2 Desg FWD 19 128.4 P2p
Fa0/3 Desg FWD 19 128.5 P2p
Fa0/4 Desg FWD 19 128.6 P2p
Fa0/24 Root FWD 19 128.26 P2p

ASw1#show spanning-tree vlan 501
VLAN0501
Spanning tree enabled protocol ieee
Root ID Priority 33269
Address 000c.853e.cf00
Cost 38
Port 8 (FastEthernet0/7)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 33269 (priority 32768 sys-id-ext 501)
Address 001e.4977.3c00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7 Root FWD 19 128.8 P2p
Fa0/8 Altn BLK 19 128.9 P2p