Lesson 25 - Switch Port Security

This post is the last one related to layer 2 technologies. With the next posts, I will shift my focus to layer 3 technologies. If you use GNS-3 or dynagen (dynamips emulator), you'll be able to perform all routing tasks on your computer as long as you have IOS image.

Switchport Port Security
This IOS feature (switch only) allows you to limit the number of MAC addresses that will be serviced on a given port. It comes with multiple options such as which MAC address(es) is/are going to be allowed on a given port, and what action should be taken when the violation of the policy occurs. This way, you can further protect your entry point in the network (access switches).

By default, the port security is turned off on all interfaces. In order to turn it on, a port must be in an access mode. Otherwise the command will be rejected. Check out the below attempt of enabling it when the port is in a 'dynamic desirable' rather than an access mode.

Pic. 1 - Port security (switchport port-security) command rejected.

 

The proper sequence of the commands to enable port security on F0/1 would be as follows:

SW1(config)#interface fastethernet0/1

SW1(config-if)#switchport mode access

SW1(config-if)#switchport port-security

The above configuration applies a default security policy on the port. What settings are going to be used here may vary between switch platforms. But typically, the port in a secure mode allows only aSINGLE MAC address (just one) to be serviced and in the case when the violation occurs, the port will be put in ERR-DISABLE state. This state will put the port down so, no traffic can traverse it.

For the purpose of my presentation, I will use very simple topology (Pic. 2).

Pic. 2 - Topology

Icons designed by: Andrzej Szoblik - http://www.newo.pl

My router R1 is connected to SW1 port F0/1. The MAC address of the R1 (E0/0 port) is:
0050.500f.6600

Now, I want accomplish the two goals:

• R1 E0/0 port should be connected to SW1 port F0/1. In case, the R1 is connected to any other port on this switch, the communication with the R1 should not be allowed.
• SW1 port F0/1 should service traffic to/from R1 E0/0 interface. In case, somebody connects more devices to port F0/1 than R1 port E0/0, and/or different device, the port F0/1 should be put in an ERR-DISABLE state.

Let us go ahead and configure it!

I need to show you what the current status of the SW1 port F0/1 is, before we apply port security.

Pic. 3 - SW1 port F0/1 Before Security is applied

As you see, the MAC address of the R1 E0/0 interface has been learned dynamically from the incoming frames on SW1 port F0/1. At this stage, I must explain the difference between dynamic and static entries in the MAC address table.

• DYNAMIC - the entry is created from the incoming frames by reading the source MAC address field in the Ethernet header. The entry is valid for 5 minutes (300 seconds) by default. If the host with this source address (here R1) does not send any frame towards the port of the SW1 for 300 seconds, the entry is removed. Every time, the R1 sends a frame towards the SW1 F0/1, the entry timer is reset, or if the entry has already been removed, the same MAC address is mapped to the port again.
• STATIC - the entry (MAC address) is permanently mapped to a specific port. It does not age like a 'dynamic' entry. The switch does not create this MAC address to port mapping by reading the source MAC address, but it is the administrator of the switch that creates it in the global config mode using 'mac address-table static' command.

 So, the question is: what is the difference in operation if you use static over dynamic method?

In case of static mapping of MAC address to a port, you CANNOT move this device to any other port as it will not work! The switch expects to receive the frames sourced from the device on the specific port. If it receives the frames with the MAC address on different port than assigned statically, it will drop the frames from that device.

If you rely on dynamic address learning (default), you can plug in a device to any port and quickly the switch flushes the entry from the old port (where the device was connected previously) and re-learns the MAC address on the new port you have just connected your device to.

Knowing that, we can proceed with our security plan now. I have applied the port access and port security commands like presented above. Now, take a look at the default settings applied on this specific switch platform I use (Catalyst 2950). Bear in mind, that your switch may have different default settings.

Pic. 4 - Port in Secure Mode.

Quick dissection of the output's essential information:

• Secure Port - F0/1 is now working in a secure mode.
• MaxSecureAddr - The maximum number of addresses allowed on this port is 1 MAC address.
• CurrentAddr - At this moment, this maximum limit has been reached.
• SecurityViolation - Currently there's been no security violation reported.
• Security Action - In case there is a security violation detected, the port will go DOWN (err-disable).

Let's see which MAC address is now in the secure mode (it should be R1 E0/0).

Pic. 5 - Current Secure MAC Address.

Everything seems good so far. F0/1 port learned dynamically the MAC address of our R1, and is now considered a secured MAC address. One of our two goal plan seems to be working. What if we moved the R1 to another port? What would happen then?

Pic. 6 - MAC address with security enabled.

This specific switch (C2950) has also made the entry 'static' which means, that if you move R1 E0/0 port to another port of this switch, the traffic from R1 will be discarded!

Well, you can further improve the security of your R1. The problem is, that with current configuration, you can reboot the switch and while doing so, you can plug in a different device to F0/1. This way the newly learned MAC address upon reload of the switch becomes the secure one. 

In order to make it more secure, it is recommended that you configure the secure MAC address permanently. Just like in the example below:

SW1(config)#interface f0/1

SW1(config-if)#shutdown

SW1(config-if)#switchport port-security address 0050.500f.6600

SW1(config-if)#no shutdown

SW1(config)#end

SW1(config)#wr

Pay attention to some of the commands presented. I shut the port down first to flush the current (the same) MAC address. Otherwise this command would be rejected (duplicate MAC address). Then, after adding the MAC address, I brought the port up and saved my configuration.

Now, the MAC address becomes the part of configuration and the security applied can withstand the reboot of the switch.

Pic. 7 - Configuration saved in NVRAM.

There is one more command that offers more detailed output (pic. 8).

Pic. 8 - Port security detailed output

Take a look at some interesting options shown below:

Pic. 9 - Port security options.

• Aging - there are two types of secure MAC address aging: 'absolute' and 'inactivity'. The former, allows to specify how long the MAC address should be considered secure, the latter decides that MAC address is no longer secure if it is not transmitting data in a given time. Both parameters can be configured but, as per default, the secure MAC addresses do not age.
• Mac-address - like in my configuration, this option specifies which address is to be secured. You can type in a specific MAC address (like I did) or use a 'sticky' keyword. When 'sticky' is used the MAC address(es) already learned on the port become part of the interface's configuration. However, adding MAC address manually is recommended. Just like I did.
• Maximum - how many MAC addresses can be considered secure on a given port (platform dependent). The default is: 1.
• Violation - this option allows to choose one of the three options as to what action must be taken if the violation of the security is detected. 

Port Violation Actions

1. Protect - when the port receives the traffic from the MAC addresses which are not configured as secure, it silently drops those transmissions. There is NO notification logged about the violation occurring on a port.
2. Restrict - similar to 'protect' only the switch logs the violations detected.
3. Shutdown (default) - the port will transition to err-disable upon detecting the violation.

Let me quickly show you what happens if my switch detects the violation of the port security.

I am going to change the MAC address on my E0/0 port of R1 to:
0000.aaaa.aaaa

As a result of that, the first frame sent towards the SW1 F0/1 will cause the violation of my policy (wrong MAC address, and the port allows only one MAC address previously assigned as the secure one).

Pic. 10 - The log generated after violation on the port occurred.

Below is the status of the port now.

Pic. 11 - Port in err-disable state upon violation of security.

The only way to rectify the situation is to do the following:

1. Plug in the device with the right (secure) MAC address back to the port F0/1.
2. Shut the port down manually (administrative mode shutdown).
3. Bring the port up using: 'no shutdown' command.

This way has one major disadvantage. Well, it seems you have to perform the three steps mentioned above which looks like you are being punished for somebody else's security violation.

You can configure two additional commands in the global configuration mode which allow your switch to attempt to bring the port automatically after a period of time in err-disable mode. If the proper device is already connected, the port will be fully functional again.

SW1(config)#errdisable recovery cause psecure-violation

SW1(config)#errdisable recovery interval 60

The first command instructs the switch to pay attention to any ports in err-disable state. If such ports exist, the switch will attempt to bring them up after 60 seconds of putting the in err-disable mode (second command).

In my next post, we will start talking about layer 3. I propose that we refresh our knowledge of binary system which is essential to understand IP addressing scheme.

Lesson 24 - Layer 2 Etherchannel

There are two more things I would like to cover in this Cisco fundamentals series that relates to switches: the etherchannel technology and switch port security. Then we move on to layer 3 stuff.

Layer 2 Etherchannel

When you're designing your network one of the factors you always consider is resiliency. Redundant connections are part of a good design. Consider picture 1 below. A rule of thumb says that if all the devices connected to SW3 (access switch on first floor) were transmitting at full speed towards distribution switches (here towards SW1) the traffic is allowed to exceed the capacity of F0/2 port onSW1 20 times. In other words, the link between access layer could oversubscribe 20:1 the link on the distribution switch. Well, it is true in most cases. Remember this is just a rule for an average network.

Pic. 1 - 2-tier network design (access+distribution layer).

Icons designed by: Andrzej Szoblik - http://www.newo.pl

In reality, the situation in which all computers begin to transmit at full speed at the same time never happens. The studies show, that the link between access and distribution switch is utilized in 7% on the average (unless some worm has been planted on your computers). In order to live up to this rule (oversubscription 20:1) you might consider access-to-distribution connection using multiple links that form a virtual connection called: etherchannel. Ports that are members of the etherchannel are represented by a virtual interface called: port-channel.

Etherchannel Advantages
Etherchannel is often used between the switches in order to increase the capacity of the connection between them by performing a load balancing of the frames traversing the channel. Load sharing (balancing) is based either on source or destination MAC address of the transmitting computers when layer 2 etherchannel is used. In case of an active link failure (the port in the channel that transmits the frames), the next link is going to transmit the packets with almost no delay. Keep in mind that the word: etherchannel, is a Cisco term. The industry standard name is link aggregation(IEEE 802.3ad).

Enough of the terminology and reasons for using the technology. Let's get practical.


Cisco offers you three ways of configuring the etherchannel ( three modes of operation):

1. Dynamic channel negotiation using Link Aggregation Control Protocol (LACP) which is the industry standard implementation.
2. Dynamic channel negotiation using Port Aggregation Protocol (PAgP) which is Cisco proprietary implementation.
3. Manual channel configuration without using any form of negotiation.

Etherchannel is a very picky technology. For the channel to be formed correctly (without STP loops etc.), there are a lot of link parameters that must match between switches. Even though I'm not a big fan of "automatic", "I-think-for-you" methods, using either LACP or PAgP seems to be a good idea here. If the channel cannot be formed we have a better reporting as to what went wrong and better protection against the loops that might form between switches on mis-configured channels. But if you use switches from different vendors and dynamic methods fails, even though all parameters, are correct, you can always resort to a manual method.

If I decided to use etherchannel in the topology presented in Pic. 1, I could use the following setup using at least two connections between, each forming a single connection like shown below:

Pic. 2 - Redundant Topology with Etherchannels.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

For the argument sake I will use a simple network topology below (pic. 3). Now, let's see the configuration options.

Pic. 3 - Topology

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Etherchannel using LACP
If you want to configure an etherchannel using a dynamic exchange of packets that is compliant with an industry standard method, the IOS offers you two mode options:

• active - in this mode the ports are actively sending negotiation frames to the other switch checking if the required parameters match and the channel can be safely formed.
• passive - in this mode the ports are waiting for the negotiation frames from the other switch in order to form a channel. The ports in the passive mode do NOT initiate any negotiation, but they will reply to negotiation frames received from a neighbor.

In pic. 3, if the parameters between ports F0/13 and F0/14 on SW1 and SW2 are correct (speed, duplex, trunking, vlans allowed etc.), the following channel modes will succeed in forming the etherchannel:

• SW1 active - SW2 active
• SW1 active - SW2 passive
• SW1 passive - SW2 active

---

NOTICE!
In case, when both use channel mode passive, the etherchannel will not form since no switch is going to start negotiation.

NOTICE!
It is imperative that you check all the settings of the ports first (all ports must have identical configuration). Candidate ports must be in the shutdown mode. This precaution is used to avoid loops and other issues while establishing the etherchannel.

---

Etherchannel using PAgP
Port Aggregation Protocol is Cisco proprietory protocol helping establish a virtual link between devices using dynamic negotiation (PAgP frames). Similarly to LACP, it has two modes of operation.

• desirable - in this mode, ports initiate negotiation frames and check if ports on a neighboring switch have proper settings to establish the etherchannel. 
• auto - in this mode, ports cannot initiate negotiation but will respond to the negotiation frames sent by a neighboring switch.

Similarly, assuming that all the port parameters are identical, the following pairs will work in the topology presented above (pic. 3):

• SW1 desirable - SW2 desirable
• SW1 desirable - SW2 auto
• SW1 auto - SW2 desirable

Etherchannel manual
This mode does not exchange any negotiation frames. Be cautious using this method, as switches won't check if port parameters match. Loops can be formed more easily than with the other two methods.

It's time to get our hands dirty!

The configuration assumes that all port parameters are IDENTICAL!

METHOD 1 - LACP (on both switches in my topology shown in pic. 2)

SW(config)#interface range f0/13 - 14

SW(config-if-range)#channel-group 1 mode active

SW(config-if-range)#end

SW#

Verification (here on SW1):

Pic. 4 -  "show etherchannel summary" command.

Pic. 5 - "show etherchannel 1 detail" command.

In the above picture (pic. 5), part of the output has been truncated for a clarity.

METHOD 2 - PAgP (on both switches in my topology shown in pic. 2)

SW(config)#interface range f0/13 - 14

SW(config-if-range)#channel-group 1 mode desirable

SW(config-if-range)#end

SW#

Verification (here on SW1):

Pic. 6 - "show etherchannel summary" command.

Pic. 7 - "show etherchannel 1 detail" output.

 

In the above picture (pic. 7), part of the output has been truncated for a clarity.

METHOD 3 - Manual (on both switches in my topology shown in pic. 2)

SW(config)#interface range f0/13 - 14

SW(config-if-range)#channel-group 1 mode on

SW(config-if-range)#end

SW#

Verification (here on SW1):

Pic. 8 - "show etherchannel summary" command.

Pic. 9 - "show etherchannel 1 detail" command.

In the above picture (pic. 9), part of the output has been truncated for a clarity.

All configurations that do NOT relate to physical aspects of the ports that are member of the etherchannel must be configured on the port-channel interface now. For instance, if you want to change the channel member ports to a trunk or access mode, the configuration must be done as follows:

SW(config)#interface port-channel 1

SW(config-if)#switchport trunk encapsulation dot1q

SW(config-if)#switchport mode trunk 

I hope this will help you get started. For more information on etherchannel, please refer to Cisco documentation.

In my next post I am going to present switch port security. After that, get ready for layer 3 stuff.

Lesson 18 - VTP and VLAN Quiz

The last lesson presented the gory details behind inter-VLAN routing. Now, I would like you to play a little game with me. A simple quiz will check your understanding of both access and trunk ports. Have fun!

Study the first topology carefully (Pic. 1) and answer the question 1.

Question1: When PC1 is sending broadcast frames (destination MAC address: FFFF.FFFF.FFFF), which computers are going to receive them?

---

NOTICE!
All switch-to-switch connections in Pic.1 are ACCESS ports. 

---

Pic. 1 - Switches are connected using ACCESS mode (NOT a trunk mode).

Icons designed by: Andrzej Szoblik - http://www.newo.pl

The answer to question 1 can be found at the bottom of this post. But try not to cheat. Check the answer after you have provided yours ;))

Study the second topology carefully (Pic. 2) and answer the question 2.

Pic. 2 - Switches are connected using TRUNKING mode.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Question2: When PC1 is sending broadcast frames (destination MAC address: FFFF.FFFF.FFFF), which computers are going to receive them?

The answer to question 1 can be found at the bottom of this post. But try not to cheat. Check the answer after you have provided yours;).

Now, I can start our last lesson related to VLANs. It's about Cisco Vlan Trunking Protocol.

Vlan Trunking Protocol (VTP)
Cisco have created this protocol to facilitate automatic VLAN distribution between switches that use trunking connection. There is similar protocol called GVRP that is industry standard solution. At first glance, it looks like it works like VTP but it has some significant differences. For more details use google to learn it.

What Does VTP Do?
VTP is turned on by default but there are some things that need to be configured for this to work. The idea is very simple: instead of typing in all the VLANs end-to-end, (on all switches individually), you can configure VLANs on one switch only, and the same configuration will be propagated to all switches in the network (VTP domain to be more accurate). By 'the same configuration', I mean that VLAN database is synchronized (exchanged) between all the switches. In other words, VLAN numbers and their names are exchanged. The port-to-VLAN assignments are NOT exchanged. Consider this example:

SW1(config)#vlan 4

SW1(config-vlan)#name IT_Dept

SW1(config-vlan)#end

SW1#

The above configuration creates 'VLAN 4' and assings the name of 'IT_Dept' to it. In a split of a second, the same VLAN 4 named IT_Dept is populated into the database of all switches in the network (VTP domain).

How Does VTP Work?
As you recall from the lesson 16, VLAN configuration typically involves three steps:

1. Configuring VLAN numbers in the 'global config' mode. Optionally, you can also give those VLAN unique names.
2. Assigning interfaces to VLANs (access mode). Optionally, you can map MAC addresses to VLANs (access dynamic mode). But in order to use this method VMPS server is required.
3. Configuring trunking connections between the switches (if the same VLANs are applied on all switches - aka end-to-end VLANs).

Even though VTP is turned on by default, a few things must be configured for VLANs to be distributed among switches.

1. Switches must belong to the same VTP domain (the same domain name must be configured on the switches to synchronize their VLAN databases).
2. If, optionally, switches use domain password, this password must be identical on all switches in the VTP domain.
3. The connections between switches must be in the 'trunking mode' (it is Vlan TRUNKING Protocol after all).
4. VTP version must be the same on all switches (there are VTP 1,2 or 3 version).

VTP Modes
A Cisco switch can be configured in one of the three VTP modes:

• VTP Server (default mode) - this mode allow you to add, remove, delete, modify VLANs to a database. All is saved in NVRAM (Non-Volatile RAM memory - the one that does not lose its content on power-down). 
• VTP Client - in this mode you CANNOT create VLANs in the local database. The only way for the VTP client to learn VLANs is to send a request advertisement. Server respond to this, by sending information about VLANs and their names used in the domain (subset advertisement).
• VTP Transparent - is a similar to a server mode of operation. The major difference is that, the transparent mode does NOT participate in the VTP domain. This means that the transparent mode does NOT synchronize its database with any other switch (a local database of VLANs), and it does NOT learn VLANs propagated by a VTP server. Transparent mode WILL forward VTP messages between other switches over trunk ports.

VTP server sends a special VTP frame every 5 minutes out of all trunking ports. This message is the summary advertisement. In this message, among other pieces of information, it inlcudes: 

• VTP domain name
• MD5 digest (if password is used in VTP domain)
• Revision number

If there is a topology change (VLAN added, removed, name modified etc.), VTP server sends newsummary advertisement IMMEDIATELY with the revision number incremented. All other switches, upon receiving this message, will compare their own VTP domain name, protocol version, MD5 digest (if used), and the revision number. If the 'revision number' in the incoming message is HIGHER than the last seen, they send an advertisement request message towards the server. The VTP server responds with one or more subset advertisement describing all the VLANs found in its database. This new information is going to replace the old one on all other VTP client or server switches.

VTP Pruning
Vlan Trunking Protocol offers one more interesting feature called: PRUNING. It allows the switches to communicate over trunks which VLAN traffic should not be sent down from the upstream switch. Consider the Pic. 3 below:

Pic. 3 - VTP VLAN Pruning Example.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

If SW1 is sending broadcast from VLAN 10, the frames will be flooded out of all active ports in VLAN 10 as well as the trunking ports. Recall, that the ports in the trunking mode are multi VLAN ports allowing ALL of them by default (VLANs 1-4094). SW2 receives the broadcast from VLAN 10, on its interface F0/13, but then realizes, that currently there are NO members of VLAN 10 connected to any of its ports.

When VTP Pruning is enabled, SW2 will inform SW1 (pic. 3), that it does not want to receive traffic from VLAN 10. Should you connect at least one host to VLAN 10 to SW2 though, it will send another request, that VLAN 10 be on longer pruned on SW1 trunk port F0/13. It happens automatically without any further configuration.

Of course, if you do not want to use VTP, you do not have to. You can configure VLANs manually on all switches of yours. Also, you can prune the traffic on trunk ports manually. The command is shown below:

SW1#conf t

SW1(config)#interface f0/13

SW1(config-if)#switchport encapsulation dot1q

SW1(config-if)#switchport mode trunk

SW1(config-if)#switchport trunk allowed vlan 10,15,22

SW1(config-if)#

The above configuration will allow only VLANs 10,15 and 22 to cross the trunk f0/13 (command in blue).

VTP Configuration
In order to illustrate configuration steps, I am going to use the same topology as in a few previous posts.

Pic. 4 - Topology Diagram

Icons designed by: Andrzej Szoblik - http://www.newo.pl

The default configuration looks like the output below: 'show vtp status'.

Pic. 5 - Default VTP settings.

Well, in my output, the only setting that is not the default is the 'Number of existing VLANs'. I have one VLAN configured (VLAN 500), which is my management VLAN allowing me access the switch remotely.

As you can notice, the VTP mode is server, and the domain name is empty (no domain name configured). So, the switch allows you to configure VLANs but the database is not going to be propagate to other switches. Below are the steps of introducing VTP protocol for the first time.

---

NOTICE!

The command: vtp mode transparent in the 'global config' mode will clear the revision number back to '0'.

---

In my topology I am going to use the secure way of introducing VTP protocol FOR THE FIRST TIME!!!

Step 1
Clear the revision number on all the switches by typing the following in the 'global config' mode:

switch(config)#vtp mode transparent

switch(config)#

Step 2
Initially, I am going to use SW1 as the VTP server, SW2 and SW3 as the VTP clients.

SW1(config)#vtp mode server

SW1(config)#

SW2(config)#vtp mode client

SW2(config)#

SW3(config)#vtp mode client

SW3(config)#

Step 3
Configure VTP domain on SW1 (here domain name = CCNA).

SW1(config)#vtp domain CCNA

---

NOTICE!
SW1 is going to propagate the domain name (CCNA) to all other switches. They will learn it on their trunk ports. Trunk ports were configured in my previous lab.

---

Step 4
Apply the same password (MD5 algorithm is used), on all switches, so if somebody plugs in a new switch, that new switch without this password is not going to change the VLANs configured so far. Here the password used is: Secret123

SW1(config)#vtp password Secret123

SW1(config)#

SW2(config)#vtp password Secret123

SW2(config)#

SW3(config)#vtp password Secret123

SW3(config)#

Step 5 (Optional)
Enable VTP pruning to save bandwidth by not transmitting the broadcast traffic towards switches that have no members of VLANs defined in their databases. If you configure this on SW1 (server), this will enable pruning on all switches in our VTP domain.

SW1(config)#vtp pruning

If you want to make other switches servers, you can change their mode of operation now.

This way we have introduced VTP domain and now you can add, remove, delete, modify VLANs on one switch (VTP server), and all these changes will be propagated to all of switches (VTP servers or clients) in your domain CCNA.

I will have two videos recorded soon. The first one will provide you with explanation to the answers of my quiz presented above. The second one will show you how VTP can cause serious problems in your network if you do not take the right precautions.

And now, let me give you the answers to the quiz questions.

The answer for question 1 (pic. 1):
The broadcast frames sent by PC1 will be sent to PC2 and PC5.

The answer for question 2 (pic. 2):
The broadcast frames sent by PC1 will be sent to PC3 and PC6.

In my next post I will talk about Spanning-Tree Protocol. 

Lesson 16 - VLANs In Practice

Lesson 15 introduced another layer 2 concept called VLANs (Virtual Local Area Networks). If you understand their purpose, it is time to get the juices flow by configuring them.

In this post, I am going to show you how to configure VLANs in a simple design, routing between VLANs and how to verify their operation. I am going to use the following network topology to accomplish our goals (Pic. 1).

Pic. 1 - VLAN Topology

Icons designed by: Andrzej Szoblik - http://www.newo.pl

---

NOTICE!
In my testing topology (pic.1) I have already configured the management VLAN (500), for the purpose of accessing the switches and R1 remotely from my computer.

VLANs 10 and 20 as well as the R1 routing configuration have not been configure yet. This is going to be our main task in this lesson.

---

Before we begin, take a closer look at the the topology (click at the picture to enlarge it). Please, pay a special attention to the IP addresses of the computers. Have you noticed that they belong to two DIFFERENT layer 3 networks? The blue numbers below denote the network address and they are different. If you are not familiar with IP addresses, and you have no clue what I'm talking about, don't worry. I'm going to explain those in the upcoming lessons.  

• PC1 address is 192.168.10.1 255.255.255.0 
• PC2 address is 192.168.20.1 255.255.255.0

For now though, take for granted that if computers are members of different layer 3 networks, the applications installed on them cannot communicate without a router.

Okay, it's time to type in our first command: show vlans.

Pic. 2 - 'show vlans' command.

The output (Pic.2) gives you a plethora of information. Take a closer look and then read on to know what you're looking at.

1. VLAN - This column shows all VLANs that exist in a switch database. In the case of my switch, there is only one VLAN I have created (VLAN 500). I've named it HOME_LAN. I use it be able to access my equipment using Telnet. All other VLANs listed exist on a switch by default. You can safely ignore these as they are not even supported by the switch (VLANs 1002-1005). Important is VLAN 1, which is the default one. All interfaces belong to VLAN 1 by default.
2. Name - This column lists the names given to VLANs. Switches use numbers to differentiate between VLANs, not names. You name VLANs using friendly names, so we know which VLAN number is which group. If you do not give a name to a newly created VLAN, the default name is given (e.g. Vlan0002 for VLAN 2, Vlan0003 for VLAN 3 etc.).
3. Status - It tells you what VLANs are active and supported by a switch. If you delete VLAN from the database, and the port is still configured as member of this VLAN, the port is not going to forward any frames. Default VLAN (VLAN=1) CANNOT be removed. You can try, but it won't work.
4. Ports - The last column, shows which ports belong to VLANs. Simple as that. In order to change VLAN's membership of the interface, you have to do it manually.

Below, you can see some additional parameters related to the VLANs such as MTU (Maximum Transmission Unit), which for Ethernet is 1500 bytes.

A more handy command is: show vlan brief. Take a look at its output (pic. 3).

Pic. 3 - 'show vlan brief' output.

This is probably more often used command if you want to check the VLANs and port membership.

Interfaces have default settings which are not seen in the running configuration:
show running-config.

In order to verify what are the default settings of the interface use the following command (here interface f0/1 is used):
show interface f0/1 switchport.

Familiarize yourself with the output of this command. Pay a special attention to the lines I highlighted.

Pic. 4 - 'show interface f0/1 switchport' output.

Recall from the previous lesson (Lesson 15) the two types of the ports used in VLAN infrastructure: trunk and access. I need to ramble a tad more before we proceed to the configuration.

1. Administrative Mode: dynamic desirable - This option means that the port is running Dynamic Trunk Protocol (DTP). Port int this mode (the default setting on this particular switch), will send special frames to the device connected to it, trying to negotiate trunk connection. If the other end responds to this proposal, both interfaces become trunks. Since in my case, it is a PC that is connected to port F0/1, and did not respond to this negotiation (no DTP), the port became a 'static access' (member of one VLAN only).
2. Operational Mode: static access – This tells you what the real mode of the port is. Here, the interface did not negotiate trunk connections so automatically became an 'access' interface.
3. Negotiation of Trunking: On – This option informs you, that the DTP protocol is active on the interface. The port will be sending DTP frames out trying to negotiate trunk mode.
4. Access Mode VLAN: 1 (default) – Since the interface did not become trunk, and there is no manual configuration regarding the VLAN it should belong to, the interface ended up as a member of the default VLAN (VLAN 1).
5. Trunking VLANs Enabled: All – In case the interface transitions to a trunking mode, ALL VLANs are going to be allowed on this interface (1-4094).

Now, it is time to define our configuration tasks and complete our mission.

CONFIGURATION STEPS

Given the topology diagram (pic. 1), configure the following:

1. Configure end-to-end VLANs (the same set of VLANs on all switches).
2. Assign ports to VLANs.
3. Create an unconditional trunking between the switches.
4. Enable routing between VLANs using 'router on a stick' (yes, it is a real name of this method).

SOLUTION

Step 1
Configure end-to-end VLANs (the same set of VLANs on all switches).

On SW1:

SW1#configure terminal

SW1(config)#vlan 10,20

SW1(config-vlan)#exit

SW1(config)#

On SW2:

SW2#configure terminal

SW2(config)#vlan 10,20

SW2(config-vlan)#exit

SW2(config)#

On SW3:

SW3#configure terminal

SW3(config)#vlan 10,20

SW3(config-vlan)#exit

SW3(config)#

Verification

On all switches you should see the VLANs created (here SW1 output).

Pic. 5 – VLANs in the database

Steps 2
Assign ports to VLANs.

Since we are going to use port-to-vlan assignment (recommended in most cases) , this option puts the ports permanently in a given VLAN and disables DTP.

On SW1:

SW1(config)#interface f0/1

SW1(config-if)#switchport mode access

SW1(config-if)#switchport access vlan 10

SW1(config-if)#exit

SW1(config)#

On SW2:

SW2(config)#int f0/1

SW2(config-if)#switchport mode access

SW2(config-if)#switchport access vlan 20

SW2(config-if)#exit

SW2(config)#

Explanation!
The command: 'switchport mode access' puts the port in an unconditional 'access mode' in which DTP is turned off. The port CANNOT become trunk anymore.

The command: 'switchport access vlan 10' places the interface in VLAN 10 (broadcast domain). From now on, the port can communicate with other hosts in VLAN 10 but not other VLANs.

Verification (here only SW1 output)

Pic.6 – show vlan brief

As you can see the port f0/1 is now a member of VLAN 10.

Step 3
Create an unconditional trunking between the switches. 

---

NOTICE!
The trunking should be enabled on ports f0/15, f0/16 and also on f0/1 since this port will use trunking mode to connect multiple R1's sub-interfaces ('router on a stick') for the purpose of routing unicast between VLANs 10 and 20.

Also, in my case SW3 is Catalyst 2950 which supports only DOT1q protocol. That is why the command 'switchport trunk encapsulation' does NOT exist on this switch. I will use that command on SW1 and SW2 though, in order to select this type of trunking protocol.

---

On SW1:

SW1(config)#interface range f0/13 - 15

SW1(config-if-range)#switchport trunk encapsulation dot1q

SW1(config-if-range)#switchport mode trunk

SW1(config-if-range)#exit

SW1(config)#

On SW2:

SW2(config)#interface range f0/13 - 14 , f0/16

SW2(config-if-range)#switchport trunk encapsulation dot1q

SW2(config-if-range)#switchport mode trunk

SW2(config-if-range)#exit

SW2(config)#

On SW3:

SW3(config)#interface range f0/1 , f0/15 - 16

SW3(config-if-range)#switchport mode trunk

SW3(config-if-range)#exit

SW3(config)#

Verification (here SW1 only):

Pic. 7 – show interface trunk

An alternate method of verifying trunk ports is shown below. However, this way you can see one port at a time. But the output is more verbose.

Pic. 8 – 'show int f0/15 switchport'

Step 4
Enable routing between VLANs using 'router on a stick'.

On R1:

R1(config)#

R1(config)#int f0/0

R1(config-if)#no ip address

R1(config-if)#no shutdown

!

! Create sub-interface with IP address to be gateway for VLAN 10.

R1(config-if)#int f0/0.10

R1(config-subif)#encapsulation dot1q 10

R1(config-subif)#ip address 192.168.10.254 255.255.255.0

R1(config-subif)#

!

! Create sub-interface with IP address to be gateway for VLAN20.

R1(config-subif)#int f0/0.20

R1(config-subif)#encapsulation dot1q 20

R1(config-subif)#ip address 192.168.20.254 255.255.255.0

R1(config-subif)#end

R1#

Verification
The ultimate test to verify the connectivity between VLANs is to use ping utility and check if PC1 talks to PC2. If successful, it is proving that our configuration is correct.

The routing table on R1 should show you that router knows both networks: 192.168.10.0/24 and 192.168.20.0/24 (pic. 9). So it can transmit the packets between these two.

Pic. 9 - Routing Table on R1

Soon, video is going to be available with the above configuration and additional options for inter-VLAN routing.

In my next post, we will look at what is really happening 'behind the curtain'. I will show you the traffic flow using our VLAN's configuration step by step.