You are on page 1of 201

CCIE R&S Lab Workbook Volume I Version 5.

0 Copyright Information
Copyright © 2008 Internetwork Expert, Inc. All rights reserved.

Bridging & Switching

The following publication, CCIE R&S Lab Workbook Volume I Version 5.0, was developed by Internetwork Expert, Inc. All rights reserved. No part of this publication may be reproduced or distributed in any form or by any means without the prior written permission of Internetwork Expert, Inc. Cisco®, Cisco® Systems, CCIE, and Cisco Certified Internetwork Expert, are registered trademarks of Cisco® Systems, Inc. and/or its affiliates in the U.S. and certain countries. All other products and company names are the trademarks, registered trademarks, and service marks of the respective owners. Throughout this manual, Internetwork Expert, Inc. has used its best efforts to distinguish proprietary trademarks from descriptive names by following the capitalization styles used by the manufacturer.

Copyright © 2008 Internetwork Expert i

www.InternetworkExpert.com

CCIE R&S Lab Workbook Volume I Version 5.0 Disclaimer

Bridging & Switching

The following publication, CCIE R&S Lab Workbook Volume I Version 5.0, is designed to assist candidates in the preparation for Cisco Systems’ CCIE Routing & Switching Lab Exam. While every effort has been made to ensure that all material is as complete and accurate as possible, the enclosed material is presented on an “as is” basis. Neither the authors nor Internetwork Expert, Inc. assume any liability or responsibility to any person or entity with respect to loss or damages incurred from the information contained in this workbook. This workbook was developed by Internetwork Expert, Inc. and is an original work of the aforementioned authors. Any similarities between material presented in this workbook and actual CCIE lab material is completely coincidental.

Copyright © 2008 Internetwork Expert ii

www.InternetworkExpert.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

Table of Contents
Bridging & Switching .......................................................................... 1
1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 1.21 1.22 1.23 1.24 1.25 1.26 1.27 1.28 1.29 1.30 1.31 1.32 1.33 1.34 1.35 1.36 1.37 1.38 1.39 1.40 1.41 1.42 Layer 2 Access Switchports ............................................................1 Layer 2 Dynamic Switchports ..........................................................1 ISL Trunking ....................................................................................1 802.1q Trunking ..............................................................................1 802.1q Native VLAN ........................................................................1 Disabling DTP Negotiation .............................................................. 2 Router-On-A-Stick ...........................................................................2 VTP .................................................................................................2 VTP Transparent .............................................................................2 VTP Pruning ....................................................................................3 VTP Prune-Eligible List....................................................................3 Layer 2 EtherChannel......................................................................3 Layer 2 EtherChannel with PAgP ....................................................3 Layer 2 EtherChannel with LACP ....................................................3 Layer 3 EtherChannel......................................................................4 802.1q Tunneling.............................................................................4 EtherChannel over 802.1q Tunneling .............................................. 5 STP Root Bridge Election................................................................ 5 STP Load Balancing with Port Cost.................................................6 STP Load Balancing with Port Priority.............................................6 Tuning STP Convergence Timers ...................................................6 STP PortFast ...................................................................................6 STP PortFast Default.......................................................................6 STP UplinkFast ...............................................................................7 STP BackboneFast..........................................................................7 STP BPDU Guard............................................................................7 STP BPDU Guard Default ...............................................................7 STP BPDU Filter..............................................................................7 STP BPDU Filter Default .................................................................8 STP Root Guard ..............................................................................8 STP Loop Guard .............................................................................8 Unidirectional Link Detection ...........................................................8 MST Root Bridge Election ............................................................... 9 MST Load Balancing with Port Cost ................................................9 MST Load Balancing with Port Priority ............................................9 MST and Rapid Spanning Tree ..................................................... 10 Protected Ports..............................................................................10 Storm Control ................................................................................10 MAC-Address Table Static Entries & Aging................................... 10 SPAN.............................................................................................10 RSPAN ..........................................................................................11 Voice VLAN ...................................................................................11 www.InternetworkExpert.com iii

Copyright © 2008 Internetwork Expert

CCIE R&S Lab Workbook Volume I Version 5.0 1.43 1.44 1.45 1.46 1.47 1.48 1.49 1.50 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 1.21 1.22 1.23 1.24 1.25 1.26 1.27 1.28 1.29 1.30 1.31 1.32 1.33 1.34 1.35 1.36

Bridging & Switching

IP Phone Trust and CoS Extend ................................................... 11 Smartport Macros .......................................................................... 12 Flex Links ......................................................................................12 Fallback Bridging ...........................................................................12 Private VLANs ...............................................................................13 PPP ...............................................................................................13 PPP AAA Authentication ............................................................... 13 PPPoE...........................................................................................14 Layer 2 Access Switchports .......................................................... 15 Layer 2 Dynamic Switchports ........................................................ 20 ISL Trunking ..................................................................................23 802.1q Trunking ............................................................................25 802.1q Native VLAN ...................................................................... 27 Disabling DTP Negotiation ............................................................ 29 Router-On-A-Stick .........................................................................32 VTP ...............................................................................................34 VTP Transparent ...........................................................................40 VTP Pruning ..................................................................................42 VTP Prune-Eligible List..................................................................45 Layer 2 EtherChannel....................................................................48 Layer 2 EtherChannel with PAgP .................................................. 56 Layer 2 EtherChannel with LACP .................................................. 62 Layer 3 EtherChannel....................................................................68 802.1q Tunneling...........................................................................71 EtherChannel over 802.1q Tunneling ............................................ 77 STP Root Bridge Election.............................................................. 82 STP Load Balancing with Port Cost............................................... 91 STP Load Balancing with Port Priority........................................... 93 Tuning STP Convergence Timers ................................................. 98 STP PortFast ...............................................................................100 STP PortFast Default................................................................... 102 STP UplinkFast ........................................................................... 104 STP BackboneFast......................................................................106 STP BPDU Guard........................................................................108 STP BPDU Guard Default ........................................................... 110 STP BPDU Filter.......................................................................... 111 STP BPDU Filter Default ............................................................. 114 STP Root Guard .......................................................................... 116 STP Loop Guard ......................................................................... 118 Unidirectional Link Detection ....................................................... 121 MST Root Bridge Election ........................................................... 125 MST Load Balancing with Port Cost ............................................ 134 MST Load Balancing with Port Priority ........................................ 138 MST and Rapid Spanning Tree ................................................... 141 www.InternetworkExpert.com iv

Bridging & Switching Solutions......................................................... 15

Copyright © 2008 Internetwork Expert

CCIE R&S Lab Workbook Volume I Version 5.0 1.37 1.38 1.39 1.40 1.41 1.42 1.43 1.44 1.45 1.46 1.47 1.48 1.49 1.50

Bridging & Switching

Protected Ports............................................................................ 143 Storm Control .............................................................................. 145 MAC-Address Table Static Entries & Aging................................. 146 SPAN........................................................................................... 149 RSPAN ........................................................................................151 Voice VLAN .................................................................................154 IP Phone Trust and CoS Extend ................................................. 157 Smartport Macros ........................................................................ 159 Flex Links ....................................................................................162 Fallback Bridging ......................................................................... 167 Private VLANs .............................................................................170 PPP .............................................................................................176 PPP AAA Authentication ............................................................. 182 PPPoE.........................................................................................189

Copyright © 2008 Internetwork Expert v

www.InternetworkExpert.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

Copyright © 2008 Internetwork Expert vi

www.InternetworkExpert.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

Bridging & Switching
Note
Load the Basic IP Addressing initial configurations prior to starting.

1.1

Layer 2 Access Switchports
Using the diagram for reference configure access VLAN assignments on SW1, SW2, SW3, and SW4 to obtain basic connectivity between the devices with Ethernet segments with the exception of R6. Do not use VTP to accomplish this.

1.2
• • •

Layer 2 Dynamic Switchports
Configure all inter-switch links on SW2, SW3, and SW4 to be in dynamic auto state. Configure all inter-switch links on SW1 to be in dynamic desirable state. Using the CAM table verify that all layer 2 traffic between devices in the same VLAN, but not attached to the same switch, is transiting SW1.

1.3
• •

ISL Trunking
Statically set the trunking encapsulation of SW1's inter-switch links to ISL. Verify that SW2, SW3, & SW4 are negotiating ISL as the trunking encapsulation to SW1, and that SW1 is not negotiating ISL to SW2, SW3, and SW4.

1.4
• •

802.1q Trunking
Change the trunking encapsulation on SW1’s inter-switch links from static ISL to static 802.1q. Verify that SW2, SW3, & SW4 are negotiating 802.1q as the trunking encapsulation to SW1, and that SW1 is not negotiating 802.1q to SW2, SW3, and SW4.

1.5

802.1q Native VLAN
Modify the native VLAN on the 802.1q trunks of SW1 so that traffic between devices in VLAN 146 is not tagged when sent over the trunk links. www.INE.com 1

Copyright © 2008 Internetwork Expert

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

1.6
• •

Disabling DTP Negotiation
Disable Dynamic Trunking Protocol on the trunk links of SW1. Verify that trunking is still occurring between SW1 & SW2, SW1 & SW3, and SW1 & SW4 without the use of DTP.

1.7
• • •

Router-On-A-Stick
Configure the link between SW2 and R6 as an 802.1q trunk link. Using the subinterfaces listed in the diagram configure R6 to route traffic for both VLANs 67 and 146 on its Ethernet link. Verify that R6 has reachability to devices both on VLAN 67 and 146.

Note
Erase and reload SW1, SW2, SW3, & SW4, and load the Basic IP Addressing initial configurations before continuing.

1.8
• • • • • • •

VTP
Configure all inter-switch links on SW2, SW3, and SW4 to be in dynamic auto state. Configure all inter-switch links on SW1 to be in dynamic desirable state. Configure SW2 as a VTP server in the domain CCIE. Configure SW1, SW3, and SW4 as VTP clients in the domain CCIE. Configure necessary VLAN definitions on SW2 using the diagram for reference. Configure access VLAN assignments on SW1, SW2, SW3, and SW4 to obtain basic connectivity between the devices with Ethernet segments. Configure router-on-a-stick between SW2 and R6 per the diagram so R6 has reachability to devices on VLANs 67 and 146.

1.9
• •

VTP Transparent
Configure SW1 in VTP transparent mode and remove all previous VLAN definitions on it. Configure SW1 with only the VLAN definitions necessary to obtain basic connectivity between the devices with Ethernet segments.

Copyright © 2008 Internetwork Expert 2

www.INE.com

Enable VTP pruning in the layer 2 network so that inter-switch broadcast replication is minimized. SW3. 1. These links should not use dynamic EtherChannel negotiation. and 14 respectively. 1. SW1 & SW3.13 Layer 2 EtherChannel with PAgP • • Modify the previous EtherChannel configuration to use PAgP for dynamic negotiation. Configure all inter-switch links on SW1 to be in dynamic desirable state. Configure Layer 2 EtherChannels on all inter-switch links between SW1 & SW2. 1. Configure all inter-switch links on SW2.CCIE R&S Lab Workbook Volume I Version 5. and SW4. SW2. and SW4 to be in dynamic auto state.11 VTP Prune-Eligible List • • Edit the prune-eligible list to ensure that traffic for VLAN 7 is carried on all active trunk links in the layer 2 network. Use Port-Channel numbers 12. 13. SW1 should initiate negotiation and the other devices should respond.12 Layer 2 EtherChannel • • • • • • Remove all previous configurations on the links connecting SW1. Copyright © 2008 Internetwork Expert 3 www.14 Layer 2 EtherChannel with LACP • • Modify the previous EtherChannel configuration to use LACP for dynamic negotiation.com . Verify this configuration is functional through the show interface trunk output.0 Bridging & Switching 1. 1. Verify this configuration is functional through the show interface trunk output.10 VTP Pruning • • • Configure SW1 in VTP client mode. SW3.INE. and SW1 & SW4. SW1 should initiate negotiation and the other devices should respond.

& SW4 before continuing.1q trunk links between SW1 & SW2’s interfaces Fa0/13.0. Configure two Ethernet subinterfaces on R1 with the IP addresses 14.INE.4/24 using VLANs 14 and 41 respectively.108. Using VLAN 100 configure an 802.1q tunnel between SW1 and SW4 to connect R1 and R4. and SW3’s interface Fa0/19 & SW4’s interface Fa0/19.0. Note Erase and reload SW1.15 Layer 3 EtherChannel • • • Configure links Fa0/16 & Fa0/17 on SW4 and links Fa0/19 & Fa0/20 on SW2 to be bound together as a Layer 3 EtherChannel.1/24 and 41. Configure two Ethernet subinterfaces on R4’s second Ethernet interface1 with the IP addresses 14.0. SW2. SW2’s interface Fa0/16 & SW3’s interface Fa0/16. 1.CCIE R&S Lab Workbook Volume I Version 5. • • • • • Copyright © 2008 Internetwork Expert 4 www.1/24 using VLANs 14 and 41 respectively.0.0.0. R1 and R4 should appear to be directly connected when viewing the show cdp neighbor output. Use Port-Channel number 24 and the subnet 155.16 802. Ensure IP reachability is obtained between these devices over the segment.0/24 per the diagram.4/24 and 41. SW3.0. Disable all other inter-switch links.1q Tunneling • Configure 802.com .0 Bridging & Switching 1.X.0.

Configure VLAN assignments per the diagram. Configure SW4 as a VTP server using the domain name CCIE with SW1. and Fa0/15 on SW1 as a layer 2 EtherChannel using PAgP for negotiation. SW1 and SW4 should form an 802. Configure an 802. SW2. If SW1 goes down SW4 should take over as the STP Root Bridge for all active VLANs.17 EtherChannel over 802. SW2 & SW4. Disable all other inter-switch links.1q trunk link between SW2 and SW3. Disable all other inter-switch links on SW1 and SW4. and load the Basic IP Addressing initial configurations before continuing. • • Note Erase and reload SW1. Configure interfaces Fa0/19.INE. To verify this configure SW1 and SW4's links to R1 and R4 in VLAN 146 per the diagram and ensure connectivity between R1 and R4.com . Configure SW1 as the STP Root Bridge for all active VLANs. 1. SW3.18 STP Root Bridge Election • • • • • • Configure the inter-switch links between SW1 & SW2. and SW3 as its clients.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching 1. and Fa0/21 on SW4 as a layer 2 EtherChannel using PAgP for negotiation.1q trunk links. Fa0/20. SW2. Copyright © 2008 Internetwork Expert 5 www. Configure SW2 and SW3 to tunnel the EtherChannel link between SW1 and SW4 using VLANs 100. SW1 & SW3. & SW4. and SW3 & SW4 as 802. Tunnel Spanning-Tree Protocol along with CDP over these links so that SW1 and SW4 appear to be directly connected when viewing the show cdp neighbor output. and 300. Configure interfaces Fa0/13. Fa0/14. 200.1q trunk link over this EtherChannel.1q Tunneling • • • • • • • Remove the previous trunking and tunneling configuration.

19 STP Load Balancing with Port Cost • Using Spanning-Tree cost modify the layer 2 transit network so that traffic for all active VLANs from SW2 to SW1 uses the last link between SW2 and SW4.INE.com . 1.20 STP Load Balancing with Port Priority • Using Spanning-Tree priority modify the layer 2 transit network so that traffic for all active VLANs from SW4 to SW1 uses the last link between SW3 and SW4. If this link goes down traffic should fall over to the second link between SW3 and SW4. If the switches do not hear a configuration message within ten seconds they should attempt reconfiguration. This configuration should impact all currently active VLANs and any additional VLANs created in the future. If this link goes down traffic should fall over to the second link between SW2 and SW4. When a new port becomes active it should wait twenty seconds before transitioning to the forwarding state. Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding. Do not use any global Spanning-Tree commands to accomplish this. • 1. • 1.CCIE R&S Lab Workbook Volume I Version 5.23 STP PortFast Default • • Remove the previous PortFast configuration. • Copyright © 2008 Internetwork Expert 6 www. Do not use any interface level Spanning-Tree commands to accomplish this.21 Tuning STP Convergence Timers • • • • Configure the switches so that they broadcast Spanning-Tree hello packets every three seconds.0 Bridging & Switching 1. • 1.22 STP PortFast • Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding.

Do not use any interface level Spanning-Tree commands to accomplish this. • • 1. Do not use the global portfast command to accomplish this.CCIE R&S Lab Workbook Volume I Version 5.com . • 1.28 STP BPDU Filter • • • Remove the previous BPDU Guard configuration.26 STP BPDU Guard • Configure Spanning-Tree BPDU Guard on the switches so that ports connected to the internal and external routers are disabled if a SpanningTree BPDU is detected. Once disabled the switches should attempt to re-enable the ports after two minutes. SW3. Configure the switches so that ports connected to the internal and external routers do not send Spanning-Tree packets sent out them.25 STP BackboneFast • Configure Spanning-Tree BackboneFast such that if the links between SW3 and SW4 go down SW2 immediately expires its maxage timer and begins Spanning-Tree reconvergence. Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding.27 STP BPDU Guard Default • • Remove the previous BPDU Guard configuration. 1. Copyright © 2008 Internetwork Expert 7 www. Do not use any global Spanning-Tree commands to accomplish this.INE.24 STP UplinkFast • Configure SW2. and SW4 with Spanning-Tree UplinkFast such that if their root port is lost they immediately reconverge to an alternate connection to their upstream bridge. Configure Spanning-Tree BPDU Guard so that if a Spanning-Tree BPDU is detected on any of these ports they are disabled. Verify this by shutting down the root port of SW2.0 Bridging & Switching 1. • • 1.

Do not use any interface level Spanning-Tree commands to accomplish this.32 Unidirectional Link Detection • • Remove the previous Loop Guard configuration. or SW4 is elected the Spanning-Tree Root Bridge for any VLAN.29 STP BPDU Filter Default • • Remove the previous BPDU Filter configuration. Copyright © 2008 Internetwork Expert 8 www. 1.CCIE R&S Lab Workbook Volume I Version 5. • • 1.30 STP Root Guard • Configure SW1 so that the links to either SW2 or SW3 are disabled if either SW2.com . Configure UDLD to prevent unidirectional links from forming on any of the inter-switch links in the layer 2 network. Configure Spanning-Tree BPDU Filter on the switches so that the PortFast enabled ports are reverted out of PortFast state if a Spanning-Tree packet is received in them. 1.31 STP Loop Guard • Configure Spanning-Tree Loop Guard to prevent unidirectional links from forming on any of the inter-switch links in the layer 2 network.0 Bridging & Switching 1. Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding.INE. SW3.

Set the cost for MST instance 1 on SW3’s links to SW1 to be 100. and SW3 as its clients.000.33 MST Root Bridge Election • • • • • • • • • • • • Configure the inter-switch links between SW1 & SW2. www. Using Spanning-Tree priority modify the layer 2 transit network so that traffic for MST instance 1 from SW4 to SW1 uses the last link between SW3 and SW4. 1. SW1 & SW3. Disable all other inter-switch links.100. SW2. and SW3 & SW4 as 802. Configure Multiple Spanning-Tree on the switches. SW2. If SW1 goes down SW2 should take over as the STP Root Bridge for instance 1. SW3. Configure SW4 as the STP Root Bridge for instance 2. If this link goes down traffic should fall over to the second link between SW3 and SW4. Configure SW4 as a VTP server using the domain name CCIE with SW1.200.INE.CCIE R&S Lab Workbook Volume I Version 5. If SW4 goes down SW3 should take over as the STP Root Bridge for instance 2. • 1. 1. and load the Basic IP Addressing initial configurations before continuing. Configure SW1 as the STP Root Bridge for instance 1. SW2 & SW4. Instance 3 should service all other VLANs.1q trunk links.0 Bridging & Switching Note Erase and reload SW1. If this link goes down traffic should fall over to the second link between SW2 and SW4. & SW4. Instance 1 should service VLANs 1 .com 9 • Copyright © 2008 Internetwork Expert . Instance 2 should service VLANs 101 . Configure VLAN assignments per the diagram.35 MST Load Balancing with Port Priority • • • Remove the previous STP cost modifications.34 MST Load Balancing with Port Cost • Using Spanning-Tree cost modify the layer 2 transit network so that traffic for MST instance 1 from SW2 to SW1 uses the last link between SW2 and SW4.

40 SPAN • • Configure SW1 so that all traffic transiting VLAN 146 is redirected to a host located on port Fa0/24. Configure a static CAM entry on SW4 so that frames destined to the MAC address of R4’s interface connected to VLAN 146 are dropped.com .38 Storm Control • • • Configure SW1 to limit unicast traffic received from R1 to 100 pps. Configure SW4 so that all traffic coming from and going to R4’s connection to VLAN 146 is redirected to a host located on port Fa0/24. where X is your rack number. R4. 1. Configure SW1 to limit broadcast traffic received from R6 to 10Mbps. 1.10.39 MAC-Address Table Static Entries & Aging • • Ensure reachability on VLAN 146 between R1. 1. Configure SW1 to limit broadcast traffic received from R4 to 1Mbps using a relative percentage of the interface bandwidth. Inbound traffic from the Linux host should be placed into VLAN 146.36 MST and Rapid Spanning Tree • Configure Rapid Spanning-Tree on the switches so that ports connected to the internal and external routers immediately begin forwarding when enabled.8/24. Copyright © 2008 Internetwork Expert 10 www. Configure port protection on SW2 so that R2 and BB2 cannot directly communicate with each other. but can communicate with SW2’s VLAN22 interface.0 Bridging & Switching 1.INE. and R6.X.37 Protected Ports • • Create a new SVI for VLAN22 on SW2 and assign it the IP address 192.CCIE R&S Lab Workbook Volume I Version 5. Configure static CAM entry for that MAC address of R6’s connection to VLAN 146 to ensure that this address is not allowed to roam. • 1. but not R4. once complete R1 and R6 should have reachability to each other.

This trust should only occur if the Cisco IP phone is present and advertises itself via CDP. Configure VLAN 146 as the native VLAN for this port and so that VLAN 600 is advertised as the voice VLAN via CDP. Configure port Fa0/2 with an access VLAN assignment of 146 and a voice VLAN assignment of 600. Create VLAN 500 as an RSPAN VLAN on all switches in the topology.1q trunk link.41 RSPAN • • • • • Disable the trunk links between SW1 and SW2. so that STP BPDUs received on the port are filtered out. • • 1. Copyright © 2008 Internetwork Expert 11 www. 1. Fa0/4. and so that the interface runs in STP portfast mode. Configure SW2 so that traffic received from and sent to R4’s connection to VLAN 43 is redirected to the RSPAN VLAN. Configure SW1 to receive traffic from the RSPAN VLAN and redirect it to a host connected to port Fa0/24.43 IP Phone Trust and CoS Extend • • • • Enable MLS QoS globally on SW1. Configure SW1 so that only VLANs 146 and 600 are permitted on this switchport.INE. and Fa0/6 on SW1 will be connected to Cisco IP phones in the near future. Inbound traffic on the link connected to this host should be placed in VLAN 146. Configure port Fa0/4 as an 802. Configure SW1 to trust the CoS of frames received on the ports connected to the IP phones.CCIE R&S Lab Workbook Volume I Version 5. Configure port Fa0/6 with an access VLAN assignment of 146. Enable Spanning-Tree portfast on this link and ensure that CDP is enabled. and for voice VLAN frames to use dot1p tagging. SW1 should enforce a CoS value of 1 to any appliance connected to the second port of the IP phone.com .0 Bridging & Switching 1.42 Voice VLAN • • • • • Ports Fa0/2.

and with the IPv6 address 2001::6/24.3/24. Configure fallback bridging on SW4 to bridge the IPv6 subnet of R4 and R6 together. Configure R6’s second Ethernet interface with the IP address 106.0. Configure R1’s Ethernet interface with the IP address 10. 1.CCIE R&S Lab Workbook Volume I Version 5. If the EtherChannel and all its members comes back up traffic should forward back over this link after 20 seconds.0. Disable all other inter-switch links. If the EtherChannel goes down traffic should immediately switch over to use the link between SW1 and SW3. • Note Erase and reload all devices to a blank configuration before continuing.0.0.0.44 Smartport Macros • Configure a macro on SW1 named VLAN_146 that when applied to an interface will set it to be an access switchport.1q trunk.0 Bridging & Switching 1. • • • 1.com . and filter Spanning-Tree BPDUs. and R3’s second Ethernet interface with the IP address 10. R2’s Ethernet interface with the IP address 10.0. apply VLAN 146 as the access vlan.1q trunk.1/24.0.0. Configure links Fa0/13 & Fa0/14 between SW1 and SW2 as an 802. Copyright © 2008 Internetwork Expert 12 www.0. Configure flex links on SW1 so that traffic from R1 to R3 uses the EtherChannel to SW2.46 Fallback Bridging • • • • • • Configure R4’s second Ethernet interface with the IP address 104. Configure link Fa0/16 on SW1 and Fa0/13 on SW3 as an 802.INE. Enable RIPv2 on all of these links. Apply this macro to ports Fa0/7 and Fa0/8 on the switch. and configure interface Fa0/4 in VLAN 104.10/24.4/24.10/24. Configure interface Fa0/6 on SW4 with the IP address 106. and with the IPv6 address 2001::4/24. Configure interface VLAN104 on SW4 with the IP address 104.0.45 Flex Links • • • • • Configure links Fa0/16 between SW2 and SW3 as an 802.6/24.1q trunked EtherChannel.0.2/24.0.0.0.

R5 should authenticate R4 using PAP only.0 Bridging & Switching Note Erase and reload all devices to a blank configuration before continuing.X. Configure the primary VLAN 100 to service private VLANs 1000. 2000. and VLAN 3000 to R6. VLAN 2000 to the links connecting to R4 & R5.48 PPP • • • • • Enable PPP encapsulation for the Serial link connecting R4 and R5 and use the IP subnet 155. 1.100. R2 can reach R3. R5 should refuse PAP authentication and use CHAP.X.49 PPP AAA Authentication • • • • Reconfigure R4 so that it attempts to authenticate R5 against the RADIUS server at the IP address 155.0. R4. 1. Ensure that R1 can reach all devices. www. R2. Reconfigure R5 so that it attempts to authenticate R4 against the TACACS+ server at the IP address 155. No other connectivity should be allowed within this topology.200. and R4 can reach R5. Use the name R5PPP and the password of CISCO to accomplish this. Assign VLAN 1000 to the links connecting to R2 & R3. and 3000.com 13 Copyright © 2008 Internetwork Expert . Use the password value of CISCO to authenticate with the remote servers.INE. R4 should use the name R4PPP and the password of CISCO.0/24 for this link R4 should attempt to authenticate R5 using PAP and than CHAP.47 Private VLANs • • • • • • • • Configure the first Ethernet interfaces of R1. R3.0.CCIE R&S Lab Workbook Volume I Version 5. while VLAN 3000 should be an isolated VLAN. VLANs 1000 and 2000 should be community VLANs.45.Y/24.146. Make sure R4 uses an alternate CHAP hostname R4CHAP. Configure the first inter-switch link between SW1 and SW2 as a trunk. The link connecting to R1 should be a promiscuous port. 1.146. and R6 with IP addresses 100. R5.X. where Y is the device number. In case if the remote AAA servers fail both R4 and R5 should use the local users database for authentication.

3 from the pool. Copyright © 2008 Internetwork Expert 14 www.35. Use R3’s interface Fa0/1 and R5’s sub-interface Fa0/1.0. R5 should block any host attempting to initiate more than 10 sessions in a minute for 5 minutes. Make sure R3 is assigned the IP address 155.com .X.50 PPPoE • • • • • • • Configure R3 as a PPPoE client and R5 as the PPPoE server.54 to accomplish this. R5 should allocate an IP address to R3 from the local DHCP pool for the subnet 155.35. 1.X.CCIE R&S Lab Workbook Volume I Version 5. You are allowed to create an additional VLAN 54 for this task.INE. R5 should authenticate R3 using CHAP and the password value of CISCO.0 • Bridging & Switching Do not use global configuration commands to define a RADIUS server in R4.

146 ! interface FastEthernet0/1 switchport access vlan 146 ! interface FastEthernet0/5 switchport access vlan 58 SW2: vlan 8.22.67.1 • Layer 2 Access Switchports Using the diagram for reference configure access VLAN assignments on SW1. • Configuration SW1: vlan 7.CCIE R&S Lab Workbook Volume I Version 5. SW2.INE.com .43.58.79. and SW4 to obtain basic connectivity between the devices with Ethernet segments with the exception of R6.79 ! interface FastEthernet0/5 switchport access vlan 5 ! interface FastEthernet0/24 switchport access vlan 43 SW4: vlan 10.43.58 ! interface FastEthernet0/2 switchport access vlan 22 ! interface FastEthernet0/4 switchport access vlan 43 ! interface FastEthernet0/24 switchport access vlan 22 SW3: vlan 5.0 Bridging & Switching Bridging & Switching Solutions 1. SW3.9. Do not use VTP to accomplish this.146 ! interface FastEthernet0/4 switchport access vlan 146 Copyright © 2008 Internetwork Expert 15 www.

per the show interface status or show vlan output.0 Verification Bridging & Switching Note For hosts connected to different physical switches but in the same VLAN.79. end-to-end transport is achieved.58. In most designs this is accomplished through VTP. Rack1SW1#ping 155.22. round-trip min/avg/max = 1/4/9 ms Copyright © 2008 Internetwork Expert 16 www. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). Note that in this solution the VLANs created on the switches are not identical. round-trip min/avg/max = 1/2/9 ms Rack1SW1#ping 155.10. Sending 5. The same connectivity result can be achieved by simply configuring the command vlan 5.9. does not have an STP instance created for VLAN 5.1. which implies that the switches in the transit path for the VLAN need to know about it in the VLAN database. In many production designs these considerations must be taken into account as all platforms have a maximum limitation of the amount of VLANs and STP instances they can support. An STP instance is automatically created on the Catalyst 3550 and 3560 platforms for a VLAN when the VLAN is created.INE. Since trunking is preconfigured between all switches in the initial configurations.1.7.9.37.1.3.8.1.9 Type escape sequence to abort. and that end-to-end connectivity exists. 100-byte ICMP Echos to 155.3 Type escape sequence to abort. to get IP connectivity to each other Spanning-Tree Protocol must be forwarding end-to-end between the hosts.CCIE R&S Lab Workbook Volume I Version 5.37. the final verification is to ensure that the VLANs are assigned correctly.43. Instead only the minimum number of necessary VLANs are created. In either case for this example however.79.67. Sending 5. who does not need VLAN 5. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). 100-byte ICMP Echos to 155. The functional difference is that SW4 for example.146 on all devices.79.com . but in this design it is accomplished simply by issuing the vlan command on all switches that need to know about it. such as R1 and R4.

10.10. Sending 5. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).254 Type escape sequence to abort.1.4.58.5 Bridging & Switching Type escape sequence to abort.1.146.146. Sending 5.254.12.1. Sending 5. round-trip min/avg/max = 4/5/8 ms Rack1R4#ping 204. 100-byte ICMP Echos to 192. round-trip min/avg/max = 1/3/4 ms Rack1R2#ping 192.1.1. 100-byte ICMP Echos to 155.1.5.1.4 Type escape sequence to abort. round-trip min/avg/max = 4/5/8 ms Rack1SW1#show interface status Port Fa0/1 Fa0/2 Fa0/3 Fa0/4 Fa0/5 Fa0/6 Fa0/7 Fa0/8 Fa0/9 Fa0/10 Fa0/11 Fa0/12 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Fa0/22 Fa0/23 Fa0/24 Gi0/1 Gi0/2 Name Status connected notconnect connected notconnect connected notconnect notconnect notconnect notconnect notconnect notconnect notconnect connected connected connected connected connected connected connected connected connected notconnect notconnect notconnect notconnect notconnect Vlan 146 1 routed 1 58 1 1 1 1 1 1 1 trunk trunk trunk trunk trunk trunk trunk trunk trunk 1 1 1 1 1 Duplex a-full auto a-half auto a-half auto auto auto auto auto auto auto a-full a-full a-full a-full a-full a-full a-full a-full a-full auto auto auto auto auto Speed a-100 auto a-10 auto a-10 auto auto auto auto auto auto auto a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 auto auto auto auto auto Type 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX Not Present Not Present Copyright © 2008 Internetwork Expert 17 www.com .254.CCIE R&S Lab Workbook Volume I Version 5.254 Type escape sequence to abort. round-trip min/avg/max = 1/2/8 ms Rack1R1#ping 155. Sending 5. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).58.12. 100-byte ICMP Echos to 155.INE.0 Rack1SW2#ping 155. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). 100-byte ICMP Echos to 204.1.

CCIE R&S Lab Workbook Volume I Version 5.0 Rack1SW2#show interface status Port Fa0/1 Fa0/2 Fa0/3 Fa0/4 Fa0/5 Fa0/6 Fa0/7 Fa0/8 Fa0/9 Fa0/10 Fa0/11 Fa0/12 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Fa0/22 Fa0/23 Fa0/24 Gi0/1 Gi0/2 Name Status notconnect connected notconnect connected notconnect notconnect notconnect notconnect notconnect notconnect notconnect notconnect connected connected connected connected connected connected connected connected connected notconnect notconnect connected notconnect notconnect Vlan 1 22 1 43 1 1 1 1 1 1 1 1 trunk trunk trunk trunk trunk trunk trunk trunk trunk 1 1 22 1 1 Bridging & Switching Duplex auto a-full auto a-half auto auto auto auto auto auto auto auto a-full a-full a-full a-full a-full a-full a-full a-full a-full auto auto a-half auto auto Speed auto a-100 auto a-10 auto auto auto auto auto auto auto auto a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 auto auto a-10 auto auto Type 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX Not Present Not Present Rack1SW3#show interface status Port Fa0/1 Fa0/2 Fa0/3 Fa0/4 Fa0/5 Fa0/6 Fa0/7 Fa0/8 Fa0/9 Fa0/10 Fa0/11 Fa0/12 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Fa0/22 Fa0/23 Fa0/24 Gi0/1 Gi0/2 Name Status notconnect notconnect connected notconnect connected notconnect notconnect notconnect notconnect notconnect notconnect notconnect connected connected connected connected connected connected connected connected connected notconnect notconnect connected notconnect notconnect Vlan 1 1 1 1 5 1 1 1 1 1 1 1 trunk trunk trunk trunk trunk trunk trunk trunk trunk 1 1 43 1 1 Duplex auto auto a-half auto a-half auto auto auto auto auto auto auto a-full a-full a-full a-full a-full a-full a-full a-full a-full auto auto a-half auto auto Speed auto auto a-10 auto a-10 auto auto auto auto auto auto auto a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 auto auto a-10 auto auto Type 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX Not Present Not Present Copyright © 2008 Internetwork Expert 18 www.INE.com .

CCIE R&S Lab Workbook Volume I Version 5.com .0 SW4#show interface status Port Fa0/1 Fa0/2 Fa0/3 Fa0/4 Fa0/5 Fa0/6 Fa0/7 Fa0/8 Fa0/9 Fa0/10 Fa0/11 Fa0/12 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Fa0/22 Fa0/23 Fa0/24 Gi0/1 Gi0/2 Name Status notconnect notconnect notconnect connected notconnect notconnect notconnect notconnect notconnect notconnect notconnect notconnect connected connected connected connected connected connected connected connected connected notconnect notconnect notconnect notconnect notconnect Vlan 1 1 1 146 1 1 1 1 1 1 1 1 trunk trunk trunk trunk trunk trunk trunk trunk trunk 1 1 1 1 1 Bridging & Switching Duplex auto auto auto a-half auto auto auto auto auto auto auto auto a-full a-full a-full a-full a-full a-full a-full a-full a-full auto auto auto auto auto Speed auto auto auto a-10 auto auto auto auto auto auto auto auto a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 a-100 auto auto auto auto auto Type 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX 10/100BaseTX unknown unknown Copyright © 2008 Internetwork Expert 19 www.INE.

com . Using the CAM table verify that all layer 2 traffic between devices in the same VLAN. round-trip min/avg/max = 1/1/4 ms Rack1R4#show arp Protocol Internet Internet Address 155.21 switchport mode dynamic auto SW4: interface range FastEthernet0/13 . Configuration SW1: interface range FastEthernet0/13 .146.1. Configure all inter-switch links on SW1 to be in dynamic desirable state.4 155.CCIE R&S Lab Workbook Volume I Version 5.6.0 Bridging & Switching 1.146.2220 Type Interface ARPA FastEthernet0/1 ARPA FastEthernet0/1 Copyright © 2008 Internetwork Expert 20 www.146.INE. and SW4 to be in dynamic auto state.1. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). 100-byte ICMP Echos to 155.1.6 Type escape sequence to abort.4461 000f.2031. Rack1R4#ping 155.24da.21 switchport mode dynamic desirable SW2: interface range FastEthernet0/13 . Sending 5.21 switchport mode dynamic auto Verification Note This verification is performed after R6’s router-on-a-stick configuration is completed.1. SW3. is transiting SW1.146.21 switchport mode dynamic auto SW3: interface range FastEthernet0/13 . but not attached to the same switch.6 Age (min) 0 Hardware Addr 0011.2 • • • Layer 2 Dynamic Switchports Configure all inter-switch links on SW2.

com . and SW4 only respond to DTP negotiation requests (auto).4461 DYNAMIC Fa0/4 Total Mac Addresses for this criterion: 1 R6’s port Fa0/0 is connected to SW2’s port Fa0/6.2220 Mac Address Table ------------------------------------------Vlan Mac Address Type Ports ------------------------1 000f. SW3. Rack1SW4#show mac-address-table dynamic address 0011. trunks will only be formed from SW1 to SW2. The result of this is indirectly verified by correlating the MAC addresses of R4 and R6 to the CAM table. and SW2.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching With SW1’s inter-switch links in dynamic desirable state.24da. This is because SW1 initiates trunking negotiation through DTP (desirable). and SW1 to SW4.2220 DYNAMIC Fa0/6 146 000f.2031.INE.24da.2031.4461 Mac Address Table ------------------------------------------Vlan Mac Address Type Ports ------------------------146 0011. SW1 to SW3. Rack1SW2#show mac-address-table dynamic address 000f.2220 DYNAMIC Fa0/6 Total Mac Addresses for this criterion: 2 Copyright © 2008 Internetwork Expert 21 www. and all other switches inter-switch links in dynamic auto state. R4’s port Fa0/1 is connected to SW4’s port Fa0/4.24da.

Rack1SW2#show mac-address-table dynamic address 0011.0 Bridging & Switching If SW2 and SW4 were trunking directly. which is built from the result of STP forwarding and blocking.com .24da. is the final layer 2 verification of how traffic is actually forwarded through the switched network.INE.4461 Mac Address Table ------------------------------------------Vlan Mac Address Type Ports ------------------------146 0011. traffic would forward between their connected ports for VLAN 146.2220 Mac Address Table ------------------------------------------Vlan Mac Address Type Ports ------------------------146 000f.2220 DYNAMIC Fa0/13 Total Mac Addresses for this criterion: 1 Copyright © 2008 Internetwork Expert 22 www. Instead SW2 sees R4’s MAC address reachable via port Fa0/13 to SW1. The CAM table.2031. and SW4 sees R6’s MAC address reachable via port Fa0/13 to SW1.24da.4461 DYNAMIC Fa0/13 Total Mac Addresses for this criterion: 1 Rack1SW4#show mac-address-table dynamic address 000f.CCIE R&S Lab Workbook Volume I Version 5.2031.

INE. These can be seen under the Mode and Encapsulation columns from the show interface trunk output.3 • • ISL Trunking Statically set the trunking encapsulation of SW1's inter-switch links to ISL. SW3. Verify that SW2. and SW4. SW3.CCIE R&S Lab Workbook Volume I Version 5. and that SW1 is not negotiating ISL to SW2.21 switchport trunk encapsulation isl Verification Note SW1’s inter-switch links are running in DTP desirable mode (initiating trunking) with ISL encapsulation statically set.com . & SW4 are negotiating ISL as the trunking encapsulation to SW1.0 Bridging & Switching 1. Configuration SW1: interface range FastEthernet0/13 . Rack1SW1#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Mode desirable desirable desirable desirable desirable desirable desirable desirable desirable Encapsulation isl isl isl isl isl isl isl isl isl Status trunking trunking trunking trunking trunking trunking trunking trunking trunking Native vlan 1 1 1 1 1 1 1 1 1 <output omitted> Copyright © 2008 Internetwork Expert 23 www.

Rack1SW2#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode auto auto auto Encapsulation n-isl n-isl n-isl Status trunking trunking trunking Native vlan 1 1 1 <output omitted> Rack1SW3#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode auto auto auto Encapsulation n-isl n-isl n-isl Status trunking trunking trunking Native vlan 1 1 1 <output omitted> Rack1SW4#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode auto auto auto Encapsulation n-isl n-isl n-isl Status trunking trunking trunking Native vlan 1 1 1 <output omitted> Copyright © 2008 Internetwork Expert 24 www. for negotiated ISL. and SW4’s inter-switch links are in DTP auto mode. Since SW1 is statically set to ISL encapsulation.INE.CCIE R&S Lab Workbook Volume I Version 5. Successful negotiation can be seen in this output since the encapsulation is n-isl.com . SW3. SW3. SW2. which means they will accept negotiation in from the other side but not initiate it. and SW4 must agree to this or DTP negotiation will fail.0 Bridging & Switching SW2.

Configuration SW1: interface range FastEthernet0/13 .1q 802. SW3. and that SW1 is not negotiating 802.1q.1q 802.1q as the trunking encapsulation to SW1.1q Status trunking trunking trunking trunking trunking trunking trunking trunking trunking Native vlan 1 1 1 1 1 1 1 1 1 Copyright © 2008 Internetwork Expert 25 www.1q 802.1q 802.21 switchport trunk encapsulation dot1q Verification Note Similar to the previous case. & SW4 are negotiating 802.1q Trunking Change the trunking encapsulation on SW1’s inter-switch links from static ISL to static 802.1q to SW2.INE. and SW4. but now has its trunking encapsulation statically set to 802.1q 802.CCIE R&S Lab Workbook Volume I Version 5.1q 802.1q 802.1q 802. SW3. Rack1SW1#show interface trunk Port Mode Fa0/13 desirable Fa0/14 desirable Fa0/15 desirable Fa0/16 desirable Fa0/17 desirable Fa0/18 desirable Fa0/19 desirable Fa0/20 desirable Fa0/21 desirable <output omitted> Encapsulation 802. SW1 is running in DTP desirable mode.com .4 • • 802.0 Bridging & Switching 1. Verify that SW2.1q.

com .1q n-802.CCIE R&S Lab Workbook Volume I Version 5.1q n-802.1q output.1q n-802. and SW4 must now agree to using dot1q trunking. as seen in the n802.1q Status trunking trunking trunking Native vlan 1 1 1 Rack1SW4#show interface trunk Port Mode Fa0/13 auto Fa0/14 auto Fa0/15 auto <output omitted> Encapsulation n-802. for negotiated dot1q.INE.1q Status trunking trunking trunking Native vlan 1 1 1 Rack1SW3#show interface trunk Port Mode Fa0/13 auto Fa0/14 auto Fa0/15 auto <output omitted> Encapsulation n-802. Rack1SW2#show interface trunk Port Mode Fa0/13 auto Fa0/14 auto Fa0/15 auto <output omitted> Encapsulation n-802. SW3.0 Bridging & Switching SW2.1q n-802.1q n-802.1q Status trunking trunking trunking Native vlan 1 1 1 Copyright © 2008 Internetwork Expert 26 www.1q n-802.

CCIE R&S Lab Workbook Volume I Version 5.15 switchport trunk native vlan 146 Verification Note The IEEE 802. it is sent the same as if 802.1q trunks of SW1 so that traffic between devices in VLAN 146 is not tagged when sent over the trunk links.1q was not configured.5 • 802.com .1q Native VLAN Modify the native VLAN on the 802.15 switchport trunk native vlan 146 SW3: interface range FastEthernet0/13 .INE. When the switch receives a frame on an interface running 802.1q encapsulation that does not have an 802. it assumes it is part of the native VLAN. For this reason the switches on both ends of an 802.21 switchport trunk native vlan 146 SW2: interface range FastEthernet0/13 .1q that does not have a tag.0 Bridging & Switching 1.15 switchport trunk native vlan 146 SW4: interface range FastEthernet0/13 . Configuration SW1: interface range FastEthernet0/13 .1q trunk link must agree on what the native VLAN is. otherwise traffic can unexpectedly leak between broadcast domain boundaries.1q trunking encapsulation standard defines the term native VLAN to describe traffic sent and received on an interface running 802. When the switch sends a frame that belongs to the native VLAN. The native VLAN defaults to 1 unless modified. In this case the native VLAN is modified to 146 on both ends of the link. Copyright © 2008 Internetwork Expert 27 www.1q tag actually inserted.

1q Status trunking trunking trunking Native vlan 146 146 146 <output omitted> Rack1SW4#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode auto auto auto Encapsulation n-802.INE.com .1q Status trunking trunking trunking trunking trunking trunking trunking trunking trunking Bridging & Switching Native vlan 146 146 146 146 146 146 146 146 146 <output omitted> Rack1SW2#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode auto auto auto Encapsulation n-802.1q 802.1q n-802.1q n-802.1q Status trunking trunking trunking Native vlan 146 146 146 <output omitted> Copyright © 2008 Internetwork Expert 28 www.1q 802.1q n-802.1q 802.1q Status trunking trunking trunking Native vlan 146 146 146 <output omitted> Rack1SW3#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode auto auto auto Encapsulation n-802.1q n-802.1q 802.1q 802.1q n-802.1q 802.CCIE R&S Lab Workbook Volume I Version 5.1q n-802.1q 802.0 Rack1SW1#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Mode desirable desirable desirable desirable desirable desirable desirable desirable desirable Encapsulation 802.1q 802.

15 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate SW3: interface range FastEthernet0/13 . and SW1 & SW4 without the use of DTP.CCIE R&S Lab Workbook Volume I Version 5. Verify that trunking is still occurring between SW1 & SW2.INE. Configuration SW1: interface range FastEthernet0/13 .6 • • Disabling DTP Negotiation Disable Dynamic Trunking Protocol on the trunk links of SW1.15 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate Copyright © 2008 Internetwork Expert 29 www.15 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate SW4: interface range FastEthernet0/13 .0 Bridging & Switching 1.21 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate SW2: interface range FastEthernet0/13 .com . SW1 & SW3.

If trunking is needed.1q Status trunking trunking trunking trunking trunking trunking trunking trunking trunking Native vlan 146 146 146 146 146 146 146 146 146 <output omitted> Copyright © 2008 Internetwork Expert 30 www.com . with the switchport mode access command. or a server’s NIC card.1q 802. but DTP is disabled. This design is most commonly used when a switch is trunking to a device that does not support DTP.CCIE R&S Lab Workbook Volume I Version 5. such as an IOS router’s routed Ethernet interface (not an EtherSwitch interface).0 Verification Bridging & Switching Note DTP negotiation can be disabled two ways. or with the switchport nonegotiate command.INE.1q 802.1q 802.1q 802.1q 802. it must be statically configured with the switchport mode trunk command.1q 802. Rack1SW1#show interface fa0/13 switchport | include Negotiation Negotiation of Trunking: Off Rack1SW1#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Mode on on on on on on on on on Encapsulation 802.1q 802.1q 802.

1q 802.1q Status trunking trunking trunking Bridging & Switching Native vlan 146 146 146 <output omitted> Rack1SW3#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode on on on Encapsulation 802.1q Status trunking trunking trunking Native vlan 146 146 146 <output omitted> Rack1SW4#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode on on on Encapsulation 802.INE.CCIE R&S Lab Workbook Volume I Version 5.1q 802.com .1q Status trunking trunking trunking Native vlan 146 146 146 <output omitted> Copyright © 2008 Internetwork Expert 31 www.1q 802.1q 802.1q 802.0 Rack1SW2#show interface trunk Port Fa0/13 Fa0/14 Fa0/15 Mode on on on Encapsulation 802.1q 802.

1. Verify that R6 has reachability to devices both on VLAN 67 and 146.255.67 encapsulation dot1q 67 ip address 155. This is generally necessary since the router does not support VTP pruning on its routed trunk interface. the attached switch must issue the switchport mode trunk command. Copyright © 2008 Internetwork Expert 32 www.com . is not required on the switch. The switchport nonegotiate command.0 ! interface FastEthernet0/0.0 Verification Note Router-on-a-stick is the legacy implementation of inter-VLAN routing.1q trunk link.146. Using the subinterfaces listed in the diagram configure R6 to route traffic for both VLANs 67 and 146 on its Ethernet link. Also to minimize the amount of broadcast traffic that the router receives the switch should ideally edit the allowed list of the trunk going to the router to only allow the VLANs that the router is encapsulating.146 ! interface FastEthernet0/6 switchport trunk encapsulation dot1q switchport mode trunk R6: interface FastEthernet0/0.6 255.146 encapsulation dot1q 146 ip address 155.6 255. which is typically replaced in most designs now with layer 3 Switch Virtual Interfaces (SVIs) on layer 3 switches. Note that since the router does not support DTP negotiation on its routed Ethernet interface.7 • • • Router-On-A-Stick Configure the link between SW2 and R6 as an 802. while recommended. rebuilds the layer 2 frame.1. and sends the packet back to the switch. In router-on-a-stick a layer 2 switch trunks multiple VLANs to a router.255. the router accepts a layer 2 packet in the physical interface.255.67.0 Bridging & Switching 1. Configuration SW2: vlan 67.INE.255. categorizes it based on the VLAN tag.CCIE R&S Lab Workbook Volume I Version 5.

Sending 5.146.22. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).43. 100-byte ICMP Echos to 155.7. round-trip min/avg/max = 1/3/5 ms Rack1R6#ping 155.67. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).INE. Sending 5.26. round-trip min/avg/max = 1/2/4 ms Rack1SW2#show interface fa0/6 trunk Port Fa0/6 Port Fa0/6 Port Fa0/6 Port Fa0/6 Mode on Encapsulation 802.com .67.58.100.1.1.8.146.1.26.100.146 Copyright © 2008 Internetwork Expert 33 www.67.CCIE R&S Lab Workbook Volume I Version 5.1. 100-byte ICMP Echos to 155.4.4 Type escape sequence to abort.146 Vlans in spanning tree forwarding state and not pruned 1-6.1q Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1-6.58.67.7 Bridging & Switching Type escape sequence to abort.43.0 Rack1R6#ping 155.8.22.

146 encapsulation dot1q 146 ip address 155.6 255.8. Configure necessary VLAN definitions on SW4 using the diagram for reference.58. SW2.0 Bridging & Switching 1.255.10.INE.43. SW3.146.22.6 255.21 switchport mode dynamic desirable ! interface FastEthernet0/1 switchport access vlan 146 ! interface FastEthernet0/5 switchport access vlan 58 SW2: vtp domain CCIE vlan 5.0 SW1: vtp domain CCIE vtp mode client ! interface range FastEthernet0/13 . Configuration R6: interface FastEthernet0/0.1. SW3. Configure all inter-switch links on SW1 to be in dynamic desirable state.255. and SW4 to be in dynamic auto state.CCIE R&S Lab Workbook Volume I Version 5. and SW4 to obtain basic connectivity between the devices with Ethernet segments.67. Configure access VLAN assignments on SW1.146 ! interface FastEthernet0/2 switchport access vlan 22 ! interface FastEthernet0/4 switchport access vlan 43 ! interface FastEthernet0/6 switchport trunk encapsulation dot1q switchport mode trunk ! Copyright © 2008 Internetwork Expert 34 www.7.com .9.0 ! interface FastEthernet0/0. Configure SW1.1.8 • • • • • • • VTP Configure all inter-switch links on SW2. Configure router-on-a-stick between SW2 and R6 per the diagram so R6 has reachability to devices on VLANs 67 and 146. and SW4 as VTP clients in the domain CCIE.67 encapsulation dot1q 67 ip address 155.67.255.255.79. Configure SW2 as a VTP server in the domain CCIE. SW3.

INE.0 interface FastEthernet0/24 switchport access vlan 22 ! interface range FastEthernet0/13 .21 switchport mode dynamic auto SW3: vtp domain CCIE vtp mode client ! interface FastEthernet0/5 switchport access vlan 5 ! interface FastEthernet0/24 switchport access vlan 43 ! interface range FastEthernet0/13 .CCIE R&S Lab Workbook Volume I Version 5.com .21 switchport mode dynamic auto Bridging & Switching Copyright © 2008 Internetwork Expert 35 www.21 switchport mode dynamic auto SW4: vtp domain CCIE vtp mode client ! interface FastEthernet0/4 switchport access vlan 146 ! interface range FastEthernet0/13 .

the VTP domain name is configured. The first step in running VTP is to ensure that the switches are trunking with each other. and the Configuration Revision Number all match.0 Verification Bridging & Switching Note VLAN Trunking Protocol (VTP) can be used in the Ethernet domain to simplify the creation and management of VLANs. Lastly on the VTP server the VLAN definitions are created.1.10.10 at 5-20-08 07:55:18 Copyright © 2008 Internetwork Expert 36 www. Next. and all other switches without domain names configured inherit this.CCIE R&S Lab Workbook Volume I Version 5. the number of existing VLANs. however it does not dictate the traffic flow of VLANs or the actual assignments. the domain is converged. To verify this configuration compare the output of the show vtp status command on all devices in the domain. Rack1SW1#show vtp status VTP Version : 2 Configuration Revision : 1 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Client VTP Domain Name : CCIE VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x7C 0x80 0x15 0x50 0xA2 0x06 0x41 0x6A Configuration last modified by 150.1. If the domain name.10.com .10 at 5-20-08 07:55:18 Rack1SW2#show vtp status VTP Version : 2 Configuration Revision : 1 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Server VTP Domain Name : CCIE VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x7C 0x80 0x15 0x50 0xA2 0x06 0x41 0x6A Configuration last modified by 150.INE. If authentication is configured the MD5 digest field should be compared as well.

CCIE R&S Lab Workbook Volume I Version 5.10.10.1.INE.10 at 5-20-08 07:55:18 Rack1SW4#show vtp status VTP Version : 2 Configuration Revision : 1 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Client VTP Domain Name : CCIE VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x7C 0x80 0x15 0x50 0xA2 0x06 0x41 0x6A Configuration last modified by 150.10.10 at 5-20-08 07:55:18 Local updater ID is 155.10 on interface Vl10 (lowest numbered VLAN interface found) Copyright © 2008 Internetwork Expert 37 www.com .1.0 Bridging & Switching Rack1SW3#show vtp status VTP Version : 2 Configuration Revision : 1 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Client VTP Domain Name : CCIE VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x7C 0x80 0x15 0x50 0xA2 0x06 0x41 0x6A Configuration last modified by 150.1.

Fa0/18 Fa0/19. Gi0/2 5 VLAN0005 active 7 VLAN0007 active 8 VLAN0008 active 9 VLAN0009 active 10 VLAN0010 active 22 VLAN0022 active 43 VLAN0043 active 58 VLAN0058 active Fa0/5 67 VLAN0067 active 79 VLAN0079 active 146 VLAN0146 active Fa0/1 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Rack1SW2#show vlan brief VLAN Name Status Ports ---. Fa0/9. Fa0/11 Fa0/12.com . Fa0/21. Fa0/7 Fa0/8.-------------------------------. Fa0/10. Fa0/16.INE.--------. Gi0/1. Fa0/22. Fa0/5.CCIE R&S Lab Workbook Volume I Version 5. Fa0/23. Fa0/7 Fa0/8. Fa0/20. Rack1SW1#show vlan brief VLAN Name Status Ports ---. Fa0/10. Fa0/9. Fa0/6. Fa0/11 Fa0/12.------------------------------1 default active Fa0/1.-------------------------------. Fa0/24 43 VLAN0043 active Fa0/4 58 VLAN0058 active 67 VLAN0067 active 79 VLAN0079 active 146 VLAN0146 active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Copyright © 2008 Internetwork Expert 38 www. Gi0/2 5 VLAN0005 active 7 VLAN0007 active 8 VLAN0008 active 9 VLAN0009 active 10 VLAN0010 active 22 VLAN0022 active Fa0/2. Fa0/3.--------. Fa0/4. Fa0/17.0 Bridging & Switching show vlan or show vlan brief can also be compared to ensure that the VLAN numbers and names properly propagated throughout the VTP domain. Fa0/24 Gi0/1.------------------------------1 default active Fa0/2. Fa0/22 Fa0/23.

Fa0/24 Gi0/1. Fa0/8. Gi0/2 5 VLAN0005 active 7 VLAN0007 active 8 VLAN0008 active 9 VLAN0009 active 10 VLAN0010 active 22 VLAN0022 active 43 VLAN0043 active 58 VLAN0058 active 67 VLAN0067 active 79 VLAN0079 active 146 VLAN0146 active Fa0/4 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Copyright © 2008 Internetwork Expert 39 www. Fa0/3. Fa0/9 Fa0/10. Gi0/1 Gi0/2 5 VLAN0005 active Fa0/5 7 VLAN0007 active 8 VLAN0008 active 9 VLAN0009 active 10 VLAN0010 active 22 VLAN0022 active 43 VLAN0043 active Fa0/24 58 VLAN0058 active 67 VLAN0067 active 79 VLAN0079 active 146 VLAN0146 active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Rack1SW4#show vlan brief VLAN Name Status Ports ---.INE. Fa0/18. Fa0/4 Fa0/6.CCIE R&S Lab Workbook Volume I Version 5. Fa0/16 Fa0/17. Fa0/23. Fa0/7.com . Fa0/22. Fa0/11. Fa0/20 Fa0/21. Fa0/2.--------.--------.------------------------------1 default active Fa0/1. Fa0/3. Fa0/5 Fa0/6. Fa0/8. Fa0/9 Fa0/10. Fa0/12. Fa0/2.-------------------------------. Fa0/23. Fa0/20 Fa0/21. Fa0/19. Fa0/11. Fa0/18.0 Rack1SW3#show vlan brief Bridging & Switching VLAN Name Status Ports ---. Fa0/7. Fa0/19. Fa0/16 Fa0/17. Fa0/12.------------------------------1 default active Fa0/1. Fa0/22.-------------------------------.

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

1.9
• •

VTP Transparent
Configure SW1 in VTP transparent mode and remove all previous VLAN definitions on it. Configure SW1 with only the VLAN definitions necessary to obtain basic connectivity between the devices with Ethernet segments.

Configuration
SW1: vtp mode transparent no vlan 2-1000 vlan 7,43,58,67,79,146

Verification

Note
VTP devices running in transparent mode do not install VTP updates received, but will continue to forward them on unmodified if the domain name matches its locally configured domain. The configuration revision number of zero indicates that it is not participating in the update sequence of the rest of the domain.

Rack1SW1#show vtp status VTP Version : 2 Configuration Revision : 0 Maximum VLANs supported locally : 1005 Number of existing VLANs : 11 VTP Operating Mode : Transparent VTP Domain Name : CCIE VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x4D 0xD1 0x7E 0x5F 0xE4 0x00 0xB6 0x86 Configuration last modified by 155.1.37.7 at 5-20-08 07:55:18

Copyright © 2008 Internetwork Expert 40

www.INE.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

Since VTP does not directly relate to STP forwarding, traffic from the server/client or from an entirely different VTP domain can be in the same broadcast domain as the transparent switches ports as long as STP is forwarding end to end. In this particular case SW1 does not have VLANs 7, 43, 67, or 79 locally assigned, but it is in the physical layer 2 transit path for these. This implies that these VLANs must be created, otherwise traffic will be received inbound but not forwarded outbound as there will be no STP instance associated with the VLAN.
Rack1SW1#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------1 default active Fa0/2, Fa0/4, Fa0/6, Fa0/7 Fa0/8, Fa0/9, Fa0/10, Fa0/11 Fa0/12, Fa0/22, Fa0/23, Fa0/24 Gi0/1, Gi0/2 7 VLAN0007 active 43 VLAN0043 active 58 VLAN0058 active Fa0/5 67 VLAN0067 active 79 VLAN0079 active 146 VLAN0146 active Fa0/1 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup

Changes in the rest of the VTP domain, such as VLAN adds or removes, do not affect the transparent switches.
Rack1SW2#conf t Enter configuration commands, one per line. Rack1SW2(config)#vlan 123 Rack1SW2(config-vlan)#end Rack1SW2#
Rack1SW2#show vlan | include ^123 123 VLAN0123 123 enet 100123 1500 Rack1SW3#show vlan | include ^123 123 VLAN0123 123 enet 100123 1500 Rack1SW1#show vlan | include ^123 active -

End with CNTL/Z.

-

-

-

0

0

-

active -

-

-

0

0

Copyright © 2008 Internetwork Expert 41

www.INE.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

1.10 VTP Pruning
• • • Configure SW1 in VTP client mode. Enable VTP pruning in the layer 2 network so that inter-switch broadcast replication is minimized. Verify this configuration is functional through the show interface trunk output.

Configuration
SW2: vtp pruning

Verification

Note
VTP pruning eliminates the need to statically remove VLANs from the allowed trunking list of a port by having the switches automatically communicate to each other which VLANs they have locally assigned or are in the transit path for. The show interface pruning command indicates what traffic the local switch told its neighbor that it needs, via the VLAN traffic requested of neighbor field. These VLANs are either ones locally assigned or those that the local switch is in the layer 2 transit path for. The Vlans pruned for lack of request by neighbor field indicates the VLANs that the upstream neighbor did not request. In the below output this means that SW1 is not forwarding VLAN 7 to SW3, because SW3 did not request it. This output can be confusing because what SW1 sees as pruned for lack of request is the opposite of what SW3 sees as requested.

Rack1SW1#show interface fa0/16 pruning Port Fa0/16 Port Fa0/16 Vlans pruned for lack of request by neighbor 7-8,10,22,58,67,146 Vlan traffic requested of neighbor 1,5,7-10,22,43,58,67,79,146

Rack1SW3#show interface fa0/13 pruning Port Fa0/13 Port Fa0/13 Vlans pruned for lack of request by neighbor none Vlan traffic requested of neighbor 1,5,9,43,79

Copyright © 2008 Internetwork Expert 42

www.INE.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

If the network is converged all devices in the VTP domain should agree that pruning is enabled, as seen in the below show vtp status output. Note that transparent switches cannot participate in pruning because they do not read the payload of the VTP updates they are receiving from their adjacent neighbors.
Rack1SW1#show vtp status VTP Version : 2 Configuration Revision : 6 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Client VTP Domain Name : CCIE VTP Pruning Mode : Enabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x4F 0x03 0x83 0x1F 0x24 0xE1 0x01 0x45 Configuration last modified by 155.1.8.8 at 5-20-08 08:27:49 Rack1SW2#show vtp status VTP Version : 2 Configuration Revision : 6 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Server VTP Domain Name : CCIE VTP Pruning Mode : Enabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x4F 0x03 0x83 0x1F 0x24 0xE1 0x01 0x45 Configuration last modified by 155.1.8.8 at 5-20-08 08:27:49 Local updater ID is 155.1.8.8 on interface Vl8 (lowest numbered VLAN interface found) Rack1SW3#show vtp status VTP Version : 2 Configuration Revision : 6 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Client VTP Domain Name : CCIE VTP Pruning Mode : Enabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x4F 0x03 0x83 0x1F 0x24 0xE1 0x01 0x45 Configuration last modified by 155.1.8.8 at 5-20-08 08:27:49

Copyright © 2008 Internetwork Expert 43

www.INE.com

79.58.79. is allowed on the link. and hence actually forwarded.79 Fa0/17 none Fa0/18 none Fa0/19 10.43.22. Rack1SW1#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/13 1.58.7-10.CCIE R&S Lab Workbook Volume I Version 5. The final field of Vlans in spanning tree forwarding state and not pruned means that the VLAN is created.8 at 5-20-08 08:27:49 Local updater ID is 155.43.com .7.43.79.5.7-10.67.5.79.1.146 Fa0/14 1 Fa0/15 1 Fa0/16 1.43. and is not pruned.58.5.10.58.146 Fa0/14 none Fa0/15 none Rack1SW3#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/13 1.7-10. is running STP.67.146 Fa0/13 5.146 Fa0/20 none Fa0/21 none Rack1SW2#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/6 1.INE. issue the show interface trunk command.67.10 on interface Vl10 (lowest numbered VLAN interface found) To quickly view what traffic is not being pruned.9.22.7-10.0 Bridging & Switching Rack1SW4#show vtp status VTP Version : 2 Configuration Revision : 6 Maximum VLANs supported locally : 1005 Number of existing VLANs : 16 VTP Operating Mode : Server VTP Domain Name : CCIE VTP Pruning Mode : Enabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x4F 0x03 0x83 0x1F 0x24 0xE1 0x01 0x45 Configuration last modified by 155.5.58.43.67.146 Fa0/14 1 Fa0/15 1 Copyright © 2008 Internetwork Expert 44 www.146 Fa0/14 1 Fa0/15 1 Rack1SW4#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/13 1.8.5.1.22.79.9-10.22.43.67.

CCIE R&S Lab Workbook Volume I Version 5.8-1001 ! interface FastEthernet0/14 switchport trunk pruning vlan 2-6.8-1001 2-6. Verify this configuration is functional through the show interface trunk output.8-1001 ! interface FastEthernet0/15 switchport trunk pruning vlan 2-6.8-1001 2-6.8-1001 SW2: interface FastEthernet0/13 switchport trunk pruning vlan 2-6.8-1001 2-6. Configuration SW1: interface FastEthernet0/13 switchport trunk pruning vlan ! interface FastEthernet0/14 switchport trunk pruning vlan ! interface FastEthernet0/15 switchport trunk pruning vlan ! interface FastEthernet0/16 switchport trunk pruning vlan ! interface FastEthernet0/17 switchport trunk pruning vlan ! interface FastEthernet0/18 switchport trunk pruning vlan ! interface FastEthernet0/19 switchport trunk pruning vlan ! interface FastEthernet0/20 switchport trunk pruning vlan ! interface FastEthernet0/21 switchport trunk pruning vlan 2-6.8-1001 2-6.8-1001 Copyright © 2008 Internetwork Expert 45 www.INE.8-1001 2-6.8-1001 2-6.8-1001 2-6.11 VTP Prune-Eligible List • • Edit the prune-eligible list to ensure that traffic for VLAN 7 is carried on all active trunk links in the layer 2 network.8-1001 2-6.com .0 Bridging & Switching 1.

com .8-1001 ! interface FastEthernet0/14 switchport trunk pruning vlan 2-6.0 SW3: interface FastEthernet0/13 switchport trunk pruning vlan 2-6.CCIE R&S Lab Workbook Volume I Version 5.8-1001 Bridging & Switching Copyright © 2008 Internetwork Expert 46 www.8-1001 ! interface FastEthernet0/14 switchport trunk pruning vlan 2-6.8-1001 ! interface FastEthernet0/15 switchport trunk pruning vlan 2-6.8-1001 SW4: interface FastEthernet0/13 switchport trunk pruning vlan 2-6.INE.8-1001 ! interface FastEthernet0/15 switchport trunk pruning vlan 2-6.

146 Fa0/14 1 Fa0/15 1 Copyright © 2008 Internetwork Expert 47 www.5.58. where SW1 sends VLAN 7 traffic over all links that are forwarding for STP.67.67. the switch must report that it does need VLAN 7. it can tell its adjacent switches not to send it VLAN 7 traffic.5. By default all VLANs 2-1001 (not the default or extended VLANs) can be pruned off of a trunk link.7 Rack1SW4#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/13 1.22.7-10.5.7-10. even though the devices on the other end of the link don’t actually need VLAN 7.43.146 Fa0/14 1.79.7-10.58.146 Fa0/14 1.5.7 Fa0/16 1.7.CCIE R&S Lab Workbook Volume I Version 5.146 Fa0/14 none Fa0/15 none Rack1SW3#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/13 1.22.43.67.43.7 Fa0/15 1.146 Fa0/20 7 Fa0/21 7 Rack1SW2#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/6 1.7.43.146 Fa0/13 5.79.5.58.79.22.INE. and is not in the transit path for VLAN 7.9.79.58.67.10.7 Fa0/15 1.58.79 Fa0/17 none Fa0/18 none Fa0/19 7. This means that if the switch does not have VLAN 7 assigned. and the traffic cannot be pruned.43.43. Rack1SW1#show interface trunk | begin pruned Port Vlans in spanning tree forwarding state and not pruned Fa0/13 1. is commonly confusing because it is essentially the opposite of the editing the allowed list of the trunk.0 Verification Bridging & Switching Note The implementation of the prune eligible list.22.67. This can be seen in the change of the output below. However.9-10.79. which is controlled by the switchport trunk pruning vlan command. if VLAN 7 is removed from the prune eligible list.com .7-10.

Use Port-Channel numbers 12. and SW1 & SW4. Configure all inter-switch links on SW2. SW3. and SW4.com .12 Layer 2 EtherChannel • • • • • • Remove all previous configurations on the links connecting SW1. Configure Layer 2 EtherChannels on all inter-switch links between SW1 & SW2.INE. and 14 respectively. SW3. Configure all inter-switch links on SW1 to be in dynamic desirable state. These links should not use dynamic EtherChannel negotiation.CCIE R&S Lab Workbook Volume I Version 5. 13. SW2. SW1 & SW3. and SW4 to be in dynamic auto state. Configuration SW1: interface FastEthernet0/13 switchport mode dynamic desirable channel-group 12 mode on ! interface FastEthernet0/14 switchport mode dynamic desirable channel-group 12 mode on ! interface FastEthernet0/15 switchport mode dynamic desirable channel-group 12 mode on ! interface FastEthernet0/16 switchport mode dynamic desirable channel-group 13 mode on ! interface FastEthernet0/17 switchport mode dynamic desirable channel-group 13 mode on ! interface FastEthernet0/18 switchport mode dynamic desirable channel-group 13 mode on ! interface FastEthernet0/19 switchport mode dynamic desirable channel-group 14 mode on ! interface FastEthernet0/20 switchport mode dynamic desirable channel-group 14 mode on ! interface FastEthernet0/21 switchport mode dynamic desirable channel-group 14 mode on Copyright © 2008 Internetwork Expert 48 www.0 Bridging & Switching 1.

com .INE.CCIE R&S Lab Workbook Volume I Version 5.0 SW2: interface FastEthernet0/13 channel-group 12 mode on ! interface FastEthernet0/14 channel-group 12 mode on ! interface FastEthernet0/15 channel-group 12 mode on SW3: interface FastEthernet0/13 channel-group 13 mode on ! interface FastEthernet0/14 channel-group 13 mode on ! interface FastEthernet0/15 channel-group 13 mode on SW4: interface FastEthernet0/13 channel-group 14 mode on ! interface FastEthernet0/14 channel-group 14 mode on ! interface FastEthernet0/15 channel-group 14 mode on Bridging & Switching Copyright © 2008 Internetwork Expert 49 www.

Rack1SW1#show etherchannel summary Flags: D I H R U u w d - down P . In the below show etherchannel summary output the Protocol field is null.0 Verification Bridging & Switching Note For an EtherChannel to form all member interfaces must agree on the same configuration. which means layer 2 switchport that is up. and both ends of the channel must agree on the same negotiation protocol.Layer2 in use f . This output also shows that the Portchannel is in the (SU) state.INE.failed to allocate aggregator unsuitable for bundling waiting to be aggregated default port Number of channel-groups in use: 3 Number of aggregators: 3 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------12 Po12(SU) Fa0/13(P) Fa0/14(P) Fa0/15(P) 13 Po13(SU) Fa0/16(P) Fa0/17(P) Fa0/18(P) 14 Po14(SU) Fa0/19(P) Fa0/20(P) Fa0/21(P) Copyright © 2008 Internetwork Expert 50 www.CCIE R&S Lab Workbook Volume I Version 5. which is in the port-channel. and the members Ports are in the (P) state. This comes from the on mode of the channel-group command.in port-channel stand-alone s .suspended Hot-standby (LACP only) Layer3 S .com . which means that no negotiation was used.

43.58.43.146 Vlans in spanning tree forwarding state and not pruned 1.43.67.58.146 1.22.com .7-10. Rack1SW1#show interface trunk Port Po12 Po13 Po14 Port Po12 Po13 Po14 Port Po12 Po13 Po14 Port Po12 Po13 Po14 Mode desirable desirable desirable Encapsulation n-isl n-isl n-isl Status trunking trunking trunking Native vlan 1 1 1 Vlans allowed on trunk 1-4094 1-4094 1-4094 Vlans allowed and active in management domain 1.43.9.146 1. This means that the channel interfaces on SW1 will initiate negotiation.79 1.146 Copyright © 2008 Internetwork Expert 51 www.79.67. and the other channels on SW2.22.79.CCIE R&S Lab Workbook Volume I Version 5.67.22.5.5.7-10.5.10.146 1.67.58.INE.0 Bridging & Switching Since SW1’s member interfaces were dynamic desirable switchports.5.79.22. and SW4 should respond.7-10. the PortChannel interfaces that are spawned from them inherit these attributes. SW3.58.43.5.79.7-10.

in port-channel I . If STP sees the single port-channel interface running one instance of STP.Layer2 U .unsuitable for bundling w .default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------12 Po12(SU) Fa0/13(P) Fa0/14(P) Fa0/15(P) Copyright © 2008 Internetwork Expert 52 www.0 Bridging & Switching An additional way to verify that a layer 2 channel is working correctly is to view the spanning-tree topology.168 128.CCIE R&S Lab Workbook Volume I Version 5.160 128.d490. but with channeling they are all forwarding.Layer3 S .176 Type -------------------------P2p P2p P2p Interface ---------------Po12 Po13 Po14 Rack1SW2#show etherchannel summary Flags: D .failed to allocate aggregator u .INE.3045. and some blocking.in use f .Hot-standby (LACP only) R . channeling has occurred properly. This is due to the fact that without channeling some member interfaces would be in the STP forwarding state.down P . Rack1SW1#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.7c00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Root Desg Sts --FWD FWD FWD Cost --------9 9 9 Prio.stand-alone s .com .4180 Cost 9 Port 168 (Port-channel13) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.suspended H .Nbr -------128.waiting to be aggregated d .

146 Vlans in spanning tree forwarding state and not pruned 1.3045.79.7-10.67.1q n-isl Status trunking trunking Bridging & Switching Native vlan 1 1 Vlans allowed on trunk 1-4094 1-4094 Vlans allowed and active in management domain 1.9-10.4180 Cost 18 Port 160 (Port-channel12) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.79.43.22.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Root Sts --FWD FWD Cost --------19 9 Prio.67.INE.22.58.43.CCIE R&S Lab Workbook Volume I Version 5.160 Type -------------------------P2p P2p Interface ---------------Fa0/6 Po12 Copyright © 2008 Internetwork Expert 53 www.58.22.5.67.5.58.7-10.8 128.Nbr -------128.79.5.43.7-10.7.d4df.com .5.43.146 1.58.79.146 Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.0 Rack1SW2#show interface trunk Port Fa0/6 Po12 Port Fa0/6 Po12 Port Fa0/6 Po12 Port Fa0/6 Po12 Mode on auto Encapsulation 802.146 1.67.

43.7-10.down P .67.--------.stand-alone s .146 Vlans in spanning tree forwarding state and not pruned 1.0 Bridging & Switching Rack1SW3#show etherchannel summary Flags: D .in port-channel I .22.Layer3 S .66 P2p Copyright © 2008 Internetwork Expert 54 www.com .58.unsuitable for bundling w .in use f .-------------------------Po13 Desg FWD 9 128.22.suspended H .-------.Hot-standby (LACP only) R .failed to allocate aggregator u .Layer2 U .CCIE R&S Lab Workbook Volume I Version 5.default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------13 Po13(SU) Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW3#show interface trunk Port Po13 Port Po13 Port Po13 Port Po13 Mode auto Encapsulation n-isl Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.INE.5.--.79.67.5.waiting to be aggregated d .Nbr Type ---------------.146 Rack1SW3#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.4180 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.58.7-10.4180 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.3045.3045.79.---.43.

Nbr Type ---------------.Hot-standby (LACP only) R .unsuitable for bundling w .com .CCIE R&S Lab Workbook Volume I Version 5.--.--------.22.Layer2 U .65 P2p Copyright © 2008 Internetwork Expert 55 www.22.79.3045.Layer3 S .stand-alone s .waiting to be aggregated d .7-10.5.7-10.---.67.in use f .in port-channel I .INE.146 Rack1SW4#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.-------------------------Po14 Root FWD 9 128.down P .failed to allocate aggregator u .4180 Cost 18 Port 65 (Port-channel14) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.43.43.3045.5.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.0 Bridging & Switching Rack1SW4#show etherchannel summary Flags: D .67.58.146 Vlans in spanning tree forwarding state and not pruned 1.-------.58.79.default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------14 Po14(SU) Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW4#show interface trunk Port Po14 Port Po14 Port Po14 Port Po14 Mode auto Encapsulation n-isl Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.suspended H .

CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching 1.13 Layer 2 EtherChannel with PAgP • • Modify the previous EtherChannel configuration to use PAgP for dynamic negotiation.INE. Configuration SW1: interface FastEthernet0/13 switchport mode dynamic desirable channel-group 12 mode desirable ! interface FastEthernet0/14 switchport mode dynamic desirable channel-group 12 mode desirable ! interface FastEthernet0/15 switchport mode dynamic desirable channel-group 12 mode desirable ! interface FastEthernet0/16 switchport mode dynamic desirable channel-group 13 mode desirable ! interface FastEthernet0/17 switchport mode dynamic desirable channel-group 13 mode desirable ! interface FastEthernet0/18 switchport mode dynamic desirable channel-group 13 mode desirable ! interface FastEthernet0/19 switchport mode dynamic desirable channel-group 14 mode desirable ! interface FastEthernet0/20 switchport mode dynamic desirable channel-group 14 mode desirable ! interface FastEthernet0/21 switchport mode dynamic desirable channel-group 14 mode desirable SW2: interface FastEthernet0/13 channel-group 12 mode auto ! interface FastEthernet0/14 channel-group 12 mode auto ! interface FastEthernet0/15 channel-group 12 mode auto Copyright © 2008 Internetwork Expert 56 www.com . SW1 should initiate negotiation and the other devices should respond.

Layer2 U .CCIE R&S Lab Workbook Volume I Version 5. while the auto mode is used to listen for negotiation. but both sides running auto will not.default port Number of channel-groups in use: 3 Number of aggregators: 3 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------12 Po12(SU) PAgP Fa0/13(P) Fa0/14(P) Fa0/15(P) 13 Po13(SU) PAgP Fa0/16(P) Fa0/17(P) Fa0/18(P) 14 Po14(SU) PAgP Fa0/19(P) Fa0/20(P) Fa0/21(P) Copyright © 2008 Internetwork Expert 57 www.INE.failed to allocate aggregator u .Hot-standby (LACP only) R .stand-alone s .Layer3 S .down P .waiting to be aggregated d . The desirable mode of PAgP.com .0 SW3: interface FastEthernet0/13 channel-group 13 mode auto ! interface FastEthernet0/14 channel-group 13 mode auto ! interface FastEthernet0/15 channel-group 13 mode auto SW4: interface FastEthernet0/13 channel-group 14 mode auto ! interface FastEthernet0/14 channel-group 14 mode auto ! interface FastEthernet0/15 channel-group 14 mode auto Bridging & Switching Verification Note Port Aggregation Protocol (PAgP) is a Cisco proprietary negotiation protocol for EtherChannel links. Rack1SW1#show etherchannel summary Flags: D . This implies that one side running desirable with the other side running desirable or auto will result in a channel.in use f .unsuitable for bundling w .suspended H . like DTP. is used to initiate negotiation.in port-channel I .

5.146 Rack1SW1#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.com .146 1.7c00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Root Desg Sts --FWD FWD FWD Cost --------9 9 9 Prio.d490.58.58.43.67.7-10.10.INE.160 128.9.Nbr -------128.0 Rack1SW1#show interface trunk Port Po12 Po13 Po14 Port Po12 Po13 Po14 Port Po12 Po13 Po14 Port Po12 Po13 Po14 Mode desirable desirable desirable Encapsulation n-isl n-isl n-isl Status trunking trunking trunking Bridging & Switching Native vlan 1 1 1 Vlans allowed on trunk 1-4094 1-4094 1-4094 Vlans allowed and active in management domain 1.22.5.5.79.43.58.79.CCIE R&S Lab Workbook Volume I Version 5.4180 Cost 9 Port 168 (Port-channel13) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.7-10.58.22.168 128.67.22.79 1.146 1.67.79.7-10.5.7-10.22.43.176 Type -------------------------P2p P2p P2p Interface ---------------Po12 Po13 Po14 Copyright © 2008 Internetwork Expert 58 www.79.43.43.67.146 1.5.146 Vlans in spanning tree forwarding state and not pruned 1.3045.

7-10.67.Nbr -------128.58.79.INE.22.suspended H .default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------12 Po12(SU) PAgP Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW2#show interface trunk Port Fa0/6 Po12 Port Fa0/6 Po12 Port Fa0/6 Po12 Port Fa0/6 Po12 Mode on auto Encapsulation 802.d4df.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Root Sts --FWD FWD Cost --------19 9 Prio.79.Layer2 U .22.3045.failed to allocate aggregator u .7-10.CCIE R&S Lab Workbook Volume I Version 5.67.43.146 Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.160 Type -------------------------P2p P2p Interface ---------------Fa0/6 Po12 Copyright © 2008 Internetwork Expert 59 www.43.stand-alone s .Layer3 S .5.146 1.5.67.8 128.0 Bridging & Switching Rack1SW2#show etherchannel summary Flags: D .com .22.in port-channel I .waiting to be aggregated d .43.5.Hot-standby (LACP only) R .4180 Cost 18 Port 160 (Port-channel12) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.146 Vlans in spanning tree forwarding state and not pruned 1.58.in use f .67.146 1.79.79.5.7-10.58.7.unsuitable for bundling w .58.43.9-10.down P .1q n-isl Status trunking trunking Native vlan 1 1 Vlans allowed on trunk 1-4094 1-4094 Vlans allowed and active in management domain 1.

---.7-10.43.5.4180 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.146 Vlans in spanning tree forwarding state and not pruned 1.failed to allocate aggregator u .4180 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.waiting to be aggregated d .43.66 P2p Copyright © 2008 Internetwork Expert 60 www.58.58.67.67.suspended H .79.Nbr Type ---------------.Layer2 U .-------.in use f .3045.0 Bridging & Switching Rack1SW3#show etherchannel summary Flags: D .stand-alone s .3045.in port-channel I .INE.Hot-standby (LACP only) R .22.com .--.5.unsuitable for bundling w .--------.Layer3 S .down P .default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------13 Po13(SU) PAgP Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW3#show interface trunk Port Po13 Port Po13 Port Po13 Port Po13 Mode desirable Encapsulation n-isl Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.22.-------------------------Po13 Desg FWD 9 128.7-10.CCIE R&S Lab Workbook Volume I Version 5.79.146 Rack1SW3#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.

58.58.---.failed to allocate aggregator u .-------------------------Po14 Root FWD 9 128.3045.43.suspended H .--------.down P .5.Layer3 S .22.--.65 P2p Copyright © 2008 Internetwork Expert 61 www.22.unsuitable for bundling w .146 Vlans in spanning tree forwarding state and not pruned 1.7-10.stand-alone s .com .79.79.Nbr Type ---------------.CCIE R&S Lab Workbook Volume I Version 5.waiting to be aggregated d .d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.67.Layer2 U .146 Rack1SW4#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.7-10.5.43.INE.4180 Cost 18 Port 65 (Port-channel14) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.67.default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------14 Po14(SU) PAgP Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW4#show interface trunk Port Po14 Port Po14 Port Po14 Port Po14 Mode desirable Encapsulation n-isl Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.0 Bridging & Switching Rack1SW4#show etherchannel summary Flags: D .Hot-standby (LACP only) R .3045.-------.in use f .in port-channel I .

Configuration SW1: interface FastEthernet0/13 switchport mode dynamic desirable channel-group 12 mode active ! interface FastEthernet0/14 switchport mode dynamic desirable channel-group 12 mode active ! interface FastEthernet0/15 switchport mode dynamic desirable channel-group 12 mode active ! interface FastEthernet0/16 switchport mode dynamic desirable channel-group 13 mode active ! interface FastEthernet0/17 switchport mode dynamic desirable channel-group 13 mode active ! interface FastEthernet0/18 switchport mode dynamic desirable channel-group 13 mode active ! interface FastEthernet0/19 switchport mode dynamic desirable channel-group 14 mode active ! interface FastEthernet0/20 switchport mode dynamic desirable channel-group 14 mode active ! interface FastEthernet0/21 switchport mode dynamic desirable channel-group 14 mode active SW2: interface FastEthernet0/13 channel-group 12 mode passive ! interface FastEthernet0/14 channel-group 12 mode passive ! interface FastEthernet0/15 channel-group 12 mode passive Copyright © 2008 Internetwork Expert 62 www.INE.CCIE R&S Lab Workbook Volume I Version 5.14 Layer 2 EtherChannel with LACP • • Modify the previous EtherChannel configuration to use LACP for dynamic negotiation.0 Bridging & Switching 1. SW1 should initiate negotiation and the other devices should respond.com .

down P . and SW4. The active mode of LACP.waiting to be aggregated d . while the passive most is used to only respond to negotiation. Rack1SW1#show etherchannel summary Flags: D .com . is used to initiate LACP negotiation.in port-channel I .Hot-standby (LACP only) R .in use f .suspended H .CCIE R&S Lab Workbook Volume I Version 5.0 SW3: interface FastEthernet0/13 channel-group 13 mode passive ! interface FastEthernet0/14 channel-group 13 mode passive ! interface FastEthernet0/15 channel-group 13 mode passive SW4: interface FastEthernet0/13 channel-group 14 mode passive ! interface FastEthernet0/14 channel-group 14 mode passive ! interface FastEthernet0/15 channel-group 14 mode passive Bridging & Switching Verification Note Similar to the previous variation of EtherChannel.stand-alone s .default port Number of channel-groups in use: 3 Number of aggregators: 3 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------12 Po12(SU) LACP Fa0/13(P) Fa0/14(P) Fa0/15(P) 13 Po13(SU) LACP Fa0/16(P) Fa0/17(P) Fa0/18(P) 14 Po14(SU) LACP Fa0/19(P) Fa0/20(P) Fa0/21(P) Copyright © 2008 Internetwork Expert 63 www.failed to allocate aggregator u .3ad. LACP is an open standard defined in IEEE 802. Link Aggregation Control Protocol (LACP) is used to negotiate the formation of the channels from SW1 to SW2.Layer2 U . but a channel will not form if both sides are passive. Like PAgP this implies that a channel will form via LACP if one side is active and the other side is active or passive.unsuitable for bundling w . SW3.Layer3 S .INE. like the desirable mode of PAgP.

22.5.CCIE R&S Lab Workbook Volume I Version 5.146 1.22.79.43.146 Vlans in spanning tree forwarding state and not pruned 1.58.146 1.58.79 1.5.5.79.43.43.67.43.7-10.7-10.43.67.22.67.10.79.22.160 128.Nbr -------128.146 1.5.176 Type -------------------------P2p P2p P2p Interface ---------------Po12 Po13 Po14 Copyright © 2008 Internetwork Expert 64 www.58.7-10.7c00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Role ---Desg Root Desg Sts --FWD FWD FWD Cost --------9 9 9 Prio.168 128.3045.5.0 Rack1SW1#show interface trunk Port Po12 Po13 Po14 Port Po12 Po13 Po14 Port Po12 Po13 Po14 Port Po12 Po13 Po14 Mode desirable desirable desirable Encapsulation n-isl n-isl n-isl Status trunking trunking trunking Bridging & Switching Native vlan 1 1 1 Vlans allowed on trunk 1-4094 1-4094 1-4094 Vlans allowed and active in management domain 1.d490.67.58.9.INE.79.7-10.146 Rack1SW1#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.4180 Cost 9 Port 168 (Port-channel13) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.com .

67.5.com .79.Layer3 S .79.43.146 1.7-10.d4df.43.146 1.stand-alone s .CCIE R&S Lab Workbook Volume I Version 5.unsuitable for bundling w .160 Type -------------------------P2p P2p Interface ---------------Fa0/6 Po12 Copyright © 2008 Internetwork Expert 65 www.in port-channel I .22.8 128.22.67.7-10.Nbr -------128.waiting to be aggregated d .58.1q n-isl Status trunking trunking Native vlan 1 1 Vlans allowed on trunk 1-4094 1-4094 Vlans allowed and active in management domain 1.down P .Hot-standby (LACP only) R .4180 Cost 18 Port 160 (Port-channel12) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.0 Bridging & Switching Rack1SW2#show etherchannel summary Flags: D .3045.58.5.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Role ---Desg Root Sts --FWD FWD Cost --------19 9 Prio.67.146 Vlans in spanning tree forwarding state and not pruned 1.43.suspended H .7-10.in use f .58.22.146 Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.9-10.INE.79.5.43.5.default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------12 Po12(SU) LACP Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW2#show interface trunk Port Fa0/6 Po12 Port Fa0/6 Po12 Port Fa0/6 Po12 Port Fa0/6 Po12 Mode on auto Encapsulation 802.79.58.Layer2 U .67.failed to allocate aggregator u .7.

---.5.Layer2 U .66 P2p Copyright © 2008 Internetwork Expert 66 www.67.58.down P .Layer3 S .CCIE R&S Lab Workbook Volume I Version 5.79.3045.22.146 Rack1SW3#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.--.INE.7-10.-------------------------Po13 Desg FWD 9 128.default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------13 Po13(SU) LACP Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW3#show interface trunk Port Po13 Port Po13 Port Po13 Port Po13 Mode desirable Encapsulation n-isl Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.4180 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.79.waiting to be aggregated d .58.7-10.146 Vlans in spanning tree forwarding state and not pruned 1.43.Nbr Type ---------------.-------.0 Bridging & Switching Rack1SW3#show etherchannel summary Flags: D .suspended H .3045.in port-channel I .67.com .Hot-standby (LACP only) R .22.stand-alone s .4180 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Interface Role Sts Cost Prio.failed to allocate aggregator u .5.unsuitable for bundling w .--------.43.in use f .

Layer2 U .146 Rack1SW4#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 000c.stand-alone s .-------------------------Po14 Root FWD 9 128.0 Bridging & Switching Rack1SW4#show etherchannel summary Flags: D .7-10.-------.default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------14 Po14(SU) LACP Fa0/13(P) Fa0/14(P) Fa0/15(P) Rack1SW4#show interface trunk Port Po14 Port Po14 Port Po14 Port Po14 Mode desirable Encapsulation n-isl Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.43.5.67.unsuitable for bundling w .waiting to be aggregated d .3045.Layer3 S .5.65 P2p Copyright © 2008 Internetwork Expert 67 www.CCIE R&S Lab Workbook Volume I Version 5.7-10.failed to allocate aggregator u .22.--.---.4180 Cost 18 Port 65 (Port-channel14) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.43.3045.suspended H .58.com .22.in use f .67.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Interface Role Sts Cost Prio.--------.INE.in port-channel I .79.Nbr Type ---------------.79.146 Vlans in spanning tree forwarding state and not pruned 1.58.down P .Hot-standby (LACP only) R .

108.CCIE R&S Lab Workbook Volume I Version 5.com .255. Configuration SW2: interface Port-channel24 no switchport ip address 155.0 ! interface FastEthernet0/19 no switchport channel-group 24 mode passive ! interface FastEthernet0/20 no switchport channel-group 24 mode passive SW4: interface Port-channel24 no switchport ip address 155.255.0 Bridging & Switching 1. Ensure IP reachability is obtained between these devices over the segment.10 255.15 Layer 3 EtherChannel • • • Configure links Fa0/16 & Fa0/17 on SW4 and links Fa0/19 & Fa0/20 on SW2 to be bound together as a Layer 3 EtherChannel.108.INE.8 255.1.1.255.108.0/24 per the diagram. Use Port-Channel number 24 and the subnet 155.X.255.0 ! interface FastEthernet0/16 no switchport channel-group 24 mode active ! interface FastEthernet0/17 no switchport channel-group 24 mode active Copyright © 2008 Internetwork Expert 68 www.

Rack1SW2#show etherchannel 24 summary Flags: D .10.default port Number of channel-groups in use: 2 Number of aggregators: 2 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------24 Po24(RU) LACP Fa0/19(P) Fa0/20(P) Rack1SW2#ping 155.stand-alone s . The important point to remember is that when the channel-group command is issued.failed to allocate aggregator u .10 Type escape sequence to abort.unsuitable for bundling w . This means that if the channel-group command is issued before the no switchport command.down P .1.in use f .Layer2 U .suspended H .1. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).CCIE R&S Lab Workbook Volume I Version 5. Note If configured properly the state of the Port-channel from the show etherchannel summary command should show (RU) for routed and in use.108.108.waiting to be aggregated d . A subsequent attempt to issue the channel-group command will generate an error message saying that the channel interface and the members are not compatible.0 Verification Bridging & Switching Pitfall One common problem with forming layer 3 EtherChannel links is the order of operations. To resolve this problem simply issue the no switchport command before the channelgroup command.Hot-standby (LACP only) R . Sending 5. the attributes of the member interfaces are immediately inherited by the Port-Channel interface.com .Layer3 S . round-trip min/avg/max = 1/1/1 ms Copyright © 2008 Internetwork Expert 69 www. the channel interface will be layer 2 and the member interfaces will be layer 3.in port-channel I . 100-byte ICMP Echos to 155.INE.

mobile.IS-IS level-1. Rack1SW2#show ip route Codes: C . 1 subnets 150.RIP.Layer2 U .EIGRP external.per-user static route o .IS-IS summary. M .CCIE R&S Lab Workbook Volume I Version 5.in port-channel I .OSPF NSSA external type 2 E1 . 3 subnets 155.IS-IS.EIGRP.1. E2 .1.INE.0/24 is subnetted.0.stand-alone s . Loopback0 Rack1SW4#show etherchannel 24 summary Flags: D .periodic downloaded static route Gateway of last resort is not set 155. L2 .BGP D . B . Vlan8 155.0 is directly connected.1.IS-IS inter area. P .1.0 is directly connected. U .0 Bridging & Switching The Port-Channel interface should show up as a normal layer 3 routed interface in the IP routing table.58.down P .1. E .OSPF inter area N1 . S .ODR.default port Number of channel-groups in use: 2 Number of aggregators: 2 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------24 Po24(RU) LACP Fa0/16(P) Fa0/17(P) Copyright © 2008 Internetwork Expert 70 www. Port-channel24 150.OSPF external type 2.1. Vlan58 C C C C 155.0.candidate default.static. N2 . IA . Rack1SW2(config)#ip routing Rack1SW2(config)#end End with CNTL/Z.0/24 is subnetted.failed to allocate aggregator u . O .unsuitable for bundling w .connected.8. EX . su . L1 . * .in use f . Rack1SW2#conf t Enter configuration commands.108.com .0 is directly connected.Layer3 S . one per line.waiting to be aggregated d .OSPF NSSA external type 1.8.EGP i .IS-IS level-2 ia .Hot-standby (LACP only) R .suspended H .0 is directly connected.OSPF. R .OSPF external type 1.

INE.1q trunk links between SW1 & SW2’s interfaces Fa0/13.4/24 using VLANs 14 and 41 respectively.41 encapsulation dot1Q 41 ip address 41.1 255. Configure two Ethernet subinterfaces on R4’s second Ethernet interface1 with the IP addresses 14.0.41 encapsulation dot1Q 41 ip address 41.0 ! interface FastEthernet0/1.0.1q Tunneling • Configure 802. and SW3’s interface Fa0/19 & SW4’s interface Fa0/19.0.255.1q tunnel between SW1 and SW4 to connect R1 and R4.16 802.1 255.0.1/24 using VLANs 14 and 41 respectively.255.0 Bridging & Switching 1.0. SW2’s interface Fa0/16 & SW3’s interface Fa0/16.0. Configure two Ethernet subinterfaces on R1 with the IP addresses 14. R1 and R4 should appear to be directly connected when viewing the show cdp neighbor output.0.0.0 Copyright © 2008 Internetwork Expert 71 www.14 encapsulation dot1Q 14 ip address 14.0.255.4 255. Using VLAN 100 configure an 802.0 ! interface FastEthernet0/0.com .0 R4: interface FastEthernet0/1 no shutdown ! interface FastEthernet0/1.0.4 255.14 encapsulation dot1Q 14 ip address 14.255.CCIE R&S Lab Workbook Volume I Version 5. • • • • • Configuration R1: interface FastEthernet0/0 no shutdown ! interface FastEthernet0/0.0.0.1/24 and 41.0. Disable all other inter-switch links.0.255.255.4/24 and 41.0.255.255.0.

com .INE.CCIE R&S Lab Workbook Volume I Version 5.0 SW1: system mtu 1504 ! interface FastEthernet0/1 switchport access vlan 100 switchport mode dot1q-tunnel l2protocol-tunnel cdp no cdp enable ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk SW2: system mtu 1504 ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk SW3: system mtu 1504 ! interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/19 switchport trunk encapsulation dot1q switchport mode trunk SW4: system mtu 1504 ! interface FastEthernet0/4 switchport access vlan 100 switchport mode dot1q-tunnel l2protocol-tunnel cdp no cdp enable ! interface FastEthernet0/19 switchport trunk encapsulation dot1q switchport mode trunk Bridging & Switching Copyright © 2008 Internetwork Expert 72 www.

Trans Bridge. or QinQ tunneling. This metro tag is used as a unique identifier for the particular customer. for the dot1q tunnel transport between R1 and R4. Combined with the layer 2 tunneling feature protocols such as CDP. and appending a new Ethernet header with a new 802. is commonly used by Metro Ethernet providers to offer a transparent layer 2 VPN to end customers. STP.INE.Repeater Device ID Rack1R1 Local Intrfce Fas 0/1 Holdtme 125 Capability R S I Platform 2610XM Port ID Fas 0/0 Copyright © 2008 Internetwork Expert 73 www. or tunnel VLAN. r .Switch. H . and VTP can be transparently transported between customer sites with no complex requirements in the customer network.com .0 Verification Bridging & Switching Note 802. Dot1q tunneling works by simply taking all traffic received by the customer. This can be easily verified through the show cdp neighbor output on R1 or R4.CCIE R&S Lab Workbook Volume I Version 5. When R1 and R4 send traffic that is already dot1q tagged from their subinterfaces into the switch network. This design has the distinct advantage over layer 3 MPLS tunnels.IGMP. T . B . the new tag of 100 is appended. as the customer edge device does not have to run a routing protocol with the service provider. In this example VLAN 100 is used as the metro tag.Host.Router. I . as even though they are not connected CDP thinks that they are.Source Route Bridge S . Rack1R4#show cdp neighbor Capability Codes: R . and an advantage over layer 2 MPLS AToM or VPLS tunnels for the service provider as the equipment and platform requirements are very moderate.1q tunneling.1q tag onto it.

timeout is 2 seconds: Packet sent with the DF bit set !!!!! Success rate is 100 percent (5/5).CCIE R&S Lab Workbook Volume I Version 5. Sending 5.0 Bridging & Switching With the addition of the second 802. Rack1SW1#show spanning-tree vlan 41 Spanning tree instance(s) for vlan 41 does not exist.0.1q Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1. they are still able to transport these as they are encapsulated inside VLAN 100.0.0.100 Copyright © 2008 Internetwork Expert 74 www.1 size 1500 df-bit Type escape sequence to abort.0.1.1.com . Note that a reload of the device is necessary before the MTU change actually goes into effect.0. SW2.INE. For this reason the system mtu command is adjusted on the layer 2 switches to allow for frames of this size. Rack1R4#ping 14. Rack1SW1#show spanning-tree vlan 14 Spanning tree instance(s) for vlan 14 does not exist.1q encapsulation an Ethernet frame already at the normal MTU of 1500 bytes will be using 1504 bytes in the service provider transit path.0. timeout is 2 seconds: Packet sent with the DF bit set !!!!! Success rate is 100 percent (5/5).0. round-trip min/avg/max = 4/5/8 ms Rack1R4#ping 41. SW3. Sending 5. and SW4 do not know about the customer’s VLANs of 14 and 41.100 Vlans in spanning tree forwarding state and not pruned 1. 1500-byte ICMP Echos to 14. round-trip min/avg/max = 4/5/8 ms Although SW1.1 size 1500 df-bit Type escape sequence to abort. Rack1SW1#show interface trunk Port Fa0/13 Port Fa0/13 Port Fa0/13 Port Fa0/13 Mode on Encapsulation 802.0. 1500-byte ICMP Echos to 41.

Rack1SW3#show interface trunk Port Fa0/16 Fa0/19 Port Fa0/16 Fa0/19 Port Fa0/16 Fa0/19 Port Fa0/16 Fa0/19 Mode on on Encapsulation 802.com .100 Vlans in spanning tree forwarding state and not pruned 1.100 1.INE.100 1.100 1. Rack1SW2#show interface trunk Port Fa0/13 Fa0/16 Port Fa0/13 Fa0/16 Port Fa0/13 Fa0/16 Port Fa0/13 Fa0/16 Mode on on Encapsulation 802.100 Vlans in spanning tree forwarding state and not pruned 1.1q Status trunking trunking Native vlan 1 1 Vlans allowed on trunk 1-4094 1-4094 Vlans allowed and active in management domain 1.1q 802.1q 802.0 Rack1SW2#show spanning-tree vlan 14 Bridging & Switching Spanning tree instance(s) for vlan 14 does not exist.CCIE R&S Lab Workbook Volume I Version 5.1q Status trunking trunking Native vlan 1 1 Vlans allowed on trunk 1-4094 1-4094 Vlans allowed and active in management domain 1.100 Rack1SW3#show spanning-tree vlan 14 Spanning tree instance(s) for vlan 14 does not exist. Rack1SW3#show spanning-tree vlan 41 Spanning tree instance(s) for vlan 41 does not exist.100 1.100 Copyright © 2008 Internetwork Expert 75 www. Rack1SW2#show spanning-tree vlan 41 Spanning tree instance(s) for vlan 41 does not exist.

0 Rack1SW4#show spanning-tree vlan 14 Bridging & Switching Spanning tree instance(s) for vlan 14 does not exist.100 Vlans in spanning tree forwarding state and not pruned 1.INE. Rack1SW4#show interface trunk Port Fa0/19 Port Fa0/19 Port Fa0/19 Port Fa0/19 Mode on Encapsulation 802.CCIE R&S Lab Workbook Volume I Version 5.1q Status trunking Native vlan 1 Vlans allowed on trunk 1-4094 Vlans allowed and active in management domain 1.100 Copyright © 2008 Internetwork Expert 76 www.com . Rack1SW4#show spanning-tree vlan 41 Spanning tree instance(s) for vlan 41 does not exist.

146. Fa0/14. Configure interfaces Fa0/19. and 300. • • Configuration R1: interface FastEthernet0/0 ip address 155.255.0 R4: interface FastEthernet0/1 ip address 155. Configure SW2 and SW3 to tunnel the EtherChannel link between SW1 and SW4 using VLANs 100.1.1q trunk link between SW2 and SW3.4 255.1q Tunneling • • • • • • • Remove the previous trunking and tunneling configuration.255. Tunnel Spanning-Tree Protocol along with CDP over these links so that SW1 and SW4 appear to be directly connected when viewing the show cdp neighbor output. Fa0/20. Disable all other inter-switch links on SW1 and SW4. and Fa0/15 on SW1 as a layer 2 EtherChannel using PAgP for negotiation.INE.1.255. Configure an 802.CCIE R&S Lab Workbook Volume I Version 5. SW1 and SW4 should form an 802. To verify this configure SW1 and SW4's links to R1 and R4 in VLAN 146 per the diagram and ensure connectivity between R1 and R4.17 EtherChannel over 802.0 SW1: vlan 146 ! interface FastEthernet0/1 switchport access vlan 146 ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk channel-group 14 mode desirable ! interface FastEthernet0/14 switchport trunk encapsulation dot1q switchport mode trunk channel-group 14 mode desirable ! interface FastEthernet0/15 switchport trunk encapsulation dot1q switchport mode trunk channel-group 14 mode desirable Copyright © 2008 Internetwork Expert 77 www. and Fa0/21 on SW4 as a layer 2 EtherChannel using PAgP for negotiation.1q trunk link over this EtherChannel.146.255.0 Bridging & Switching 1. Configure interfaces Fa0/13.com .1 255. 200.

0 SW2: vlan 100.200.INE.300 ! interface FastEthernet0/13 switchport access vlan 100 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp ! interface FastEthernet0/14 switchport access vlan 200 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp ! interface FastEthernet0/15 switchport access vlan 300 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp ! interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk SW3: vlan 100.300 ! interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/19 switchport access vlan 100 switchport trunk encapsulation dot1q switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp ! interface FastEthernet0/20 switchport access vlan 200 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp ! interface FastEthernet0/21 switchport access vlan 300 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp Bridging & Switching Copyright © 2008 Internetwork Expert 78 www.com .200.CCIE R&S Lab Workbook Volume I Version 5.

round-trip min/avg/max = 4/5/8 ms Copyright © 2008 Internetwork Expert 79 www.1.1.INE.CCIE R&S Lab Workbook Volume I Version 5.146.1. 1500-byte ICMP Echos to 155. Rack1R4#ping 155. Sending 5. timeout is 2 seconds: Packet sent with the DF bit set !!!!! Success rate is 100 percent (5/5).146.1 size 1500 df-bit Type escape sequence to abort.0 SW4: vlan 146 ! interface FastEthernet0/4 switchport access vlan 146 ! interface FastEthernet0/19 switchport trunk encapsulation dot1q switchport mode trunk channel-group 14 mode auto ! interface FastEthernet0/20 switchport trunk encapsulation dot1q switchport mode trunk channel-group 14 mode auto ! interface FastEthernet0/21 switchport trunk encapsulation dot1q switchport mode trunk channel-group 14 mode auto Bridging & Switching Verification Note By creating separate point-to-point tunnels through the usage of separate metro tags an EtherChannel between two customer edge switches can be transparently tunneled over the service provider network.com .

Nbr -------128.3045.d600 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32914 (priority 32768 sys-id-ext 146) Address 000c.65 Type -------------------------------P2p P2p Interface ---------------Fa0/4 Po14 Copyright © 2008 Internetwork Expert 80 www.CCIE R&S Lab Workbook Volume I Version 5.3 128.Nbr -------128. Rack1SW1#show spanning-tree vlan 146 VLAN0146 Spanning tree enabled protocol ieee Root ID Priority 32914 Address 000c.3045.d600. sees the root port for VLAN 146 as the port-channel interface.d600 Cost 9 Port 176 (Port-channel14) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32914 (priority 32768 sys-id-ext 146) Address 001b.3045. indicating that these two devices are in the same spanning-tree domain for this VLAN.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Desg Sts --FWD FWD Cost --------19 9 Prio.7c00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Root Sts --FWD FWD Cost --------19 9 Prio. who is the customer edge device.0 Bridging & Switching SW1.3045.176 Type -------------------------------P2p P2p Interface ---------------Fa0/1 Po14 SW4 agrees with this root bridge election for VLAN 146.com .4 128.INE. Rack1SW4#show spanning-tree vlan 146 VLAN0146 Spanning tree enabled protocol ieee Root ID Priority 32914 Address 000c. and the root bridge ID of 000c.d490.

in port-channel stand-alone s . Rack1SW1#show cdp neighbor Capability Codes: R .CCIE R&S Lab Workbook Volume I Version 5. Rack1SW3#show spanning-tree vlan 146 Spanning tree instance(s) for vlan 146 does not exist.Repeater. H .com .failed to allocate aggregator unsuitable for bundling waiting to be aggregated default port Number of channel-groups in use: 3 Number of aggregators: 3 Group Port-channel Protocol Ports ------+-------------+-----------+---------------------------------------------14 Po14(SU) PAgP Fa0/13(P) Fa0/14(P) Fa0/15(P) SW1 and SW4 think that they are directly connected over these tunneled channel ports via CDP.Router. 200.0 Bridging & Switching SW2 and SW3 do not agree on the STP topology for VLAN 146 the same as SW1 and SW4. B .suspended Hot-standby (LACP only) Layer3 S . and 300.INE.Source Route Bridge S . P .Layer2 in use f .Trans Bridge. Rack1SW1#show etherchannel summary Flags: D I H R U u w d down P . r .Host. T . I . Rack1SW2#show spanning-tree vlan 146 Spanning tree instance(s) for vlan 146 does not exist.IGMP.Switch. because STP BPDUs received from SW1 and SW4 are transparently tunneled inside the metro VLAN tags of 100.Phone Device ID Rack1SW4 Rack1SW4 Rack1SW4 Rack1R1 Rack1R3 Rack1R5 Local Intrfce Fas 0/15 Fas 0/14 Fas 0/13 Fas 0/1 Fas 0/3 Fas 0/5 Holdtme 153 153 153 131 128 124 Capability S I S I S I R S I R S I R S I Platform Port ID WS-C3550-2Fas 0/21 WS-C3550-2Fas 0/20 WS-C3550-2Fas 0/19 2610XM Fas 0/0 2611XM Fas 0/0 2611XM Fas 0/0 Copyright © 2008 Internetwork Expert 81 www.

5. SW2. Configuration SW1: vtp domain CCIE vtp mode client ! spanning-tree vlan 1.0 Bridging & Switching 1.18 STP Root Bridge Election • • • • • • Configure the inter-switch links between SW1 & SW2.CCIE R&S Lab Workbook Volume I Version 5.com .58.1q trunk links. and SW3 & SW4 as 802. Configure SW1 as the STP Root Bridge for all active VLANs. SW2 & SW4. and SW3 as its clients.22.INE.146 priority 0 ! interface FastEthernet0/1 switchport access vlan 146 ! interface FastEthernet0/5 switchport access vlan 58 ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/14 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/15 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/17 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/18 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/19 shutdown ! Copyright © 2008 Internetwork Expert 82 www. SW1 & SW3.43.7-10. Configure SW4 as a VTP server using the domain name CCIE with SW1. Configure VLAN assignments per the diagram. Disable all other inter-switch links.67. If SW1 goes down SW4 should take over as the STP Root Bridge for all active VLANs.79.

com .0 interface FastEthernet0/20 shutdown ! interface FastEthernet0/21 shutdown SW2: vtp domain CCIE vtp mode client ! interface FastEthernet0/2 switchport access vlan 22 ! interface FastEthernet0/4 switchport access vlan 43 ! interface FastEthernet0/6 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/13 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/14 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/15 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/16 shutdown ! interface FastEthernet0/17 shutdown ! interface FastEthernet0/18 shutdown ! interface FastEthernet0/19 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/20 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/21 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/24 switchport access vlan 22 Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q dot1q Copyright © 2008 Internetwork Expert 83 www.INE.CCIE R&S Lab Workbook Volume I Version 5.

7.67.CCIE R&S Lab Workbook Volume I Version 5.67.22.58.9.43.INE.146 ! spanning-tree vlan 1.0 SW3: vtp domain CCIE vtp mode client ! interface FastEthernet0/5 switchport access vlan 5 ! interface FastEthernet0/13 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/14 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/15 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/16 shutdown ! interface FastEthernet0/17 shutdown ! interface FastEthernet0/18 shutdown ! interface FastEthernet0/19 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/20 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/21 switchport trunk encapsulation switchport mode trunk Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q SW4: vtp domain CCIE vlan 5.5.10.com .79.8.22.7-10.58.79.43.146 priority 4096 ! interface FastEthernet0/4 switchport access vlan 146 ! interface FastEthernet0/13 shutdown ! interface FastEthernet0/14 shutdown ! interface FastEthernet0/15 shutdown Copyright © 2008 Internetwork Expert 84 www.

com .CCIE R&S Lab Workbook Volume I Version 5.0 ! interface FastEthernet0/16 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/17 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/18 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/19 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/20 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/21 switchport trunk encapsulation switchport mode trunk Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q Verification Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is Rack1SW1#show spanning-tree This bridge is vlan 146 | include root the root vlan 1 | include root the root vlan 5 | include root the root vlan 7 | include root the root vlan 8 | include root the root vlan 9 | include root the root vlan 10 | include root the root vlan 22 | include root the root vlan 43 | include root the root vlan 58 | include root the root vlan 67 | include root the root vlan 79 | include root the root vlan 146 | include root the root Copyright © 2008 Internetwork Expert 85 www.INE.

18 128.INE. If there is a tie in priority the device with the lowest MAC address is elected root.d490.16 128.com . In this case SW1’s BID is 1.Nbr -------128.20 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Copyright © 2008 Internetwork Expert 86 www. shows that This bridge is the root. The device with the lowest priority value is elected the root.7c00.19 128.0 Bridging & Switching Note STP root bridge election is based on the priority and MAC address fields of the Bridge ID.7c00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Desg Desg Desg Desg Desg Sts --FWD FWD FWD FWD FWD FWD Cost --------19 19 19 19 19 19 Prio. the configured priority of zero plus the system id extension (VLAN number).17 128.7c00 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 1 (priority 0 sys-id-ext 1) Address 001b. The root bridge should show the same priority and MAC address for both the Root ID and the Bridge ID.CCIE R&S Lab Workbook Volume I Version 5.d490.15 128. SW1 with the local priority of one. and list all interfaces as Designated (downstream facing).001b. Rack1SW1#show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 1 Address 001b.d490.

d4df.d490.0 Bridging & Switching SW2 agrees that the device with the BID 1.ec80.16 128.d4df.23 Type -------------------------P2p P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 87 www.Nbr -------128.8 128.7c00 is the root.7c00 Cost 19 Port 15 (FastEthernet0/13) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32769 (priority 32768 sys-id-ext 1) Address 001b.21 128.d490. SW2’s local BID is a priority of 32769.17 128.001b. the default of 32768 plus the system id extension 1. and uses the port Fa0/13 with a total cost of 19 to reach it.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Root Altn Altn Desg Desg Desg Sts --FWD FWD BLK BLK FWD FWD FWD Cost --------19 19 19 19 19 19 19 Prio.22 128.15 128. and the MAC address 001b.com . Rack1SW2#show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 1 Address 001b.INE.CCIE R&S Lab Workbook Volume I Version 5.

14 128.7c00 Cost 19 Port 13 (FastEthernet0/13) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32769 (priority 32768 sys-id-ext 1) Address 000c. and uses the port Fa0/13 with a total cost of 19 to reach it.Nbr -------128.3045.d490.7c00 is the root.20 128. Rack1SW3#show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 1 Address 001b.0 Bridging & Switching SW3 agrees that the device with the BID 1.13 128.com .CCIE R&S Lab Workbook Volume I Version 5.001b.15 128.21 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 88 www.INE. SW3’s local BID is a priority of 32769.3045.4180 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Root Altn Altn Desg Desg Desg Sts --FWD BLK BLK FWD FWD FWD Cost --------19 19 19 19 19 19 Prio. the default of 32768 plus the system id extension 1.4180.d490. and the MAC address 000c.19 128.

0 Bridging & Switching Likewise SW4 agrees that the device with the BID 1.CCIE R&S Lab Workbook Volume I Version 5.16 128.20 128. but SW4 has a lower priority than SW2 or SW3.INE.3045.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Altn Altn Altn Root Altn Altn Sts --BLK BLK BLK FWD BLK BLK Cost --------19 19 19 19 19 19 Prio.7c00 Cost 38 Port 19 (FastEthernet0/19) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 4097 (priority 4096 sys-id-ext 1) Address 000c. Rack1SW4#show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 1 Address 001b.d490.18 128. This means that if the root bridge were to fail SW4 would be next in line to take over the root status.001b.d490.com .21 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 89 www.17 128.7c00 is the root.Nbr -------128.19 128.

3045. Rack1SW1#conf t Enter configuration commands.com .21 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 90 www.d600 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 4097 (priority 4096 sys-id-ext 1) Address 000c. one per line.Nbr -------128.0 Bridging & Switching When SW1’s trunk links are down SW4 should assume the role of the root bridge since it has the next lowest bridge priority value.20 128.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Role ---Desg Desg Desg Desg Desg Desg Sts --LIS LIS LIS FWD LIS LIS Cost --------19 19 19 19 19 19 Prio.17 128.19 128.18 Rack1SW1(config-if-range)#shut Rack1SW1(config-if-range)# Rack1SW4#show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 4097 Address 000c.INE. Rack1SW1(config)#interface range fa0/13 .18 128. End with CNTL/Z.16 128.CCIE R&S Lab Workbook Volume I Version 5.3045.

21 128.22 128.com .0 Bridging & Switching 1. If this link goes down traffic should fall over to the second link between SW2 and SW4. • Configuration SW2: interface FastEthernet0/13 spanning-tree cost 1000 ! interface FastEthernet0/14 spanning-tree cost 1000 ! interface FastEthernet0/15 spanning-tree cost 1000 ! interface FastEthernet0/20 spanning-tree cost 2 ! interface FastEthernet0/21 spanning-tree cost 1 Verification Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b.Nbr -------128.d4df.16 128.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Root Altn Altn Desg Desg Desg Sts --FWD BLK BLK FWD FWD FWD Cost --------19 19 19 19 19 19 Prio.7c00 Cost 19 Port 15 (FastEthernet0/13) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.d490.INE.CCIE R&S Lab Workbook Volume I Version 5.17 128.15 128.23 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 91 www.19 STP Load Balancing with Port Cost • Using Spanning-Tree cost modify the layer 2 transit network so that traffic for all active VLANs from SW2 to SW1 uses the last link between SW2 and SW4.

Rack1SW2(config)#interface range fa0/13 .Nbr -------128.d4df. End with CNTL/Z. Rack1SW2#conf t Enter configuration commands. one per line.15 128.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Role ---Altn Altn Altn Altn Altn Root Sts --BLK BLK BLK BLK BLK FWD Cost --------1000 1000 1000 19 2 1 Prio.d490. By changing the links to SW1 to a cost of 1000 they are the least preferred path. By changing the last link to SW4 to a cost of 1 the end to end path cost on that link becomes 39.0 Bridging & Switching Note The default cost to the root bridge from SW2 before configuration changes is 19.16 128.CCIE R&S Lab Workbook Volume I Version 5.22 128.com . 19 from SW4 to SW3.23 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 92 www.17 128. and will therefore be the second most preferred link.15 Rack1SW2(config-if-range)#spanning-tree cost 1000 Rack1SW2(config-if-range)#interface fa0/21 % Command exited out of interface range and its sub-modes.7c00 Cost 39 Port 23 (FastEthernet0/21) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b.21 128. the end to end path cost will be 40. which is the most preferred (1 to SW4.INE. Not executing the command for second and later interfaces Rack1SW2(config-if)#spanning-tree cost 1 Rack1SW2(config-if-range)#interface fa0/20 Rack1SW2(config-if)#spanning-tree cost 2 Rack1SW2(config-if)#end Rack1SW2# Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b. With the second to last link having a cost of 2. 19 from SW3 to SW1).

17 128.0 Bridging & Switching 1.20 STP Load Balancing with Port Priority • Using Spanning-Tree priority modify the layer 2 transit network so that traffic for all active VLANs from SW4 to SW1 uses the last link between SW3 and SW4.d490.18 128.3045.com .20 128. • Configuration SW3: interface FastEthernet0/20 spanning-tree port-priority 16 ! interface FastEthernet0/21 spanning-tree port-priority 0 Verification Note Before configuration changes: Rack1SW4#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b.7c00 Cost 38 Port 19 (FastEthernet0/19) Hello Time 2 sec Max Age 20 sec Bridge ID Forward Delay 15 sec Priority 4106 (priority 4096 sys-id-ext 10) Address 000c. If this link goes down traffic should fall over to the second link between SW3 and SW4.21 Type -------------------------P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 93 www.INE.19 128.16 128.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Desg Desg Desg Root Altn Altn Sts --FWD FWD FWD FWD BLK BLK Cost --------19 19 19 19 19 19 Prio.Nbr -------128.CCIE R&S Lab Workbook Volume I Version 5.

Designated root has priority 10. address 001b. Port priority 128. address 000c. Designated root has priority 10.3045. Port Identifier 128. address 001b.7c00 Designated bridge has priority 4106.d490.d490. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 71.com .CCIE R&S Lab Workbook Volume I Version 5.d490.3045. received 119 Port 17 (FastEthernet0/17) of VLAN0010 is forwarding Port path cost 19.4180 Designated port id is 128. Designated root has priority 10.d600 Configured hello time 2.7c00 Root port is 19 (FastEthernet0/19). max age 20.17. forward delay 0. received 118 Port 18 (FastEthernet0/18) of VLAN0010 is forwarding Port path cost 19. received 1126 Copyright © 2008 Internetwork Expert 94 www.7c00 Designated bridge has priority 32778.d490.0 Rack1SW4#show spanning-tree vlan 10 detail Bridging & Switching VLAN0010 is executing the ieee compatible Spanning Tree protocol Bridge Identifier has priority 4096. address 000c. notification 0. Port priority 128. designated path cost 38 Timers: message age 0.d490.d600 Designated port id is 128. designated path cost 38 Timers: message age 0. address 000c. forward delay 0. received 119 Port 19 (FastEthernet0/19) of VLAN0010 is forwarding Port path cost 19. cost of root path is 38 Topology change flag not set. address 000c.19. max age 20. detected flag not set Number of topology changes 5 last change occurred 00:08:08 ago from FastEthernet0/16 Times: hold 1. designated path cost 19 Timers: message age 2.7c00 Designated bridge has priority 4106.18. Port Identifier 128. forward delay 0. aging 300 Port 16 (FastEthernet0/16) of VLAN0010 is forwarding Port path cost 19. designated path cost 38 Timers: message age 0. forward delay 0.3045.16. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 266. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 266. sysid 10. forward delay 15 Current root has priority 10.16.3045. topology change 35. address 001b. notification 2 hello 2.17. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 266.19. Designated root has priority 10.d600 Designated port id is 128. Port Identifier 128. forward delay 15 Timers: hello 0.d600 Designated port id is 128. address 001b. topology change 0.3045. Port priority 128.INE.18. address 000c. Port Identifier 128. Port priority 128. address 001b.7c00 Designated bridge has priority 4106.

21. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 69. versus 20 and 21. Designated root has priority 10.4180 Designated port id is 128.7c00 Designated bridge has priority 32778. and the designated (upstream) port id is compared.3045. designated path cost 19 Timers: message age 3. Since SW4 is connected to SW3 out all three links. one per line. and Fa0/20 will be chosen. Fa0/19 is the root port on SW4.3045.com . Port priority 128. Rack1SW3#conf t Enter configuration commands. received 1125 Port 21 (FastEthernet0/21) of VLAN0010 is blocking Port path cost 19.20.d490. SW4 prefers the port with the lowest designated port priority. End with CNTL/Z.7c00 Designated bridge has priority 32778. received 1125 Since interfaces Fa0/19 – 21 on SW4 all have the same end to end path cost of 38 the designated (upstream) bridge-id is compared.d490. Port Identifier 128. By changing the upstream priority on SW3 on ports Fa0/20 and Fa0/21.21. Port priority 128.20.4180 Designated port id is 128. Rack1SW3(config)#interface fa0/21 Rack1SW3(config-if)#spanning-tree port-priority 0 Rack1SW3(config-if)#interface fa0/20 Rack1SW3(config-if)#spanning-tree port-priority 16 Rack1SW3(config-if)#end Rack1SW3# Copyright © 2008 Internetwork Expert 95 www. forward delay 0.0 Bridging & Switching Port 20 (FastEthernet0/20) of VLAN0010 is blocking Port path cost 19. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 69. address 001b. forward delay 0. If interface Fa0/21 on SW4 goes down it will compare the upstream priority of Fa0/20 (16) with the upstream priority of Fa0/19 (128).CCIE R&S Lab Workbook Volume I Version 5.INE. Since the upstream port number of Fa0/19 is 19. designated path cost 19 Timers: message age 3. Designated root has priority 10. address 001b. Port Identifier 128. address 000c. there is a tie in the designated bridge-id. address 000c.

CCIE R&S Lab Workbook Volume I Version 5.0
Rack1SW4#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b.d490.7c00 Cost 38 Port 21 (FastEthernet0/21) Hello Time 2 sec Max Age 20 sec Bridge ID

Bridging & Switching

Forward Delay 15 sec

Priority 4106 (priority 4096 sys-id-ext 10) Address 000c.3045.d600 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Role ---Desg Desg Desg Altn Altn Root Sts --FWD FWD FWD BLK BLK LRN Cost --------19 19 19 19 19 19 Prio.Nbr -------128.16 128.17 128.18 128.19 128.20 128.21 Type -------------------------P2p P2p P2p P2p P2p P2p

Interface ---------------Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21

Rack1SW4#show spanning-tree vlan 10 detail VLAN0010 is executing the ieee compatible Spanning Tree protocol Bridge Identifier has priority 4096, sysid 10, address 000c.3045.d600 Configured hello time 2, max age 20, forward delay 15 Current root has priority 10, address 001b.d490.7c00 Root port is 21 (FastEthernet0/21), cost of root path is 38 Topology change flag set, detected flag not set Number of topology changes 6 last change occurred 00:00:19 ago from FastEthernet0/19 Times: hold 1, topology change 35, notification 2 hello 2, max age 20, forward delay 15 Timers: hello 0, topology change 0, notification 0, aging 15 Port 16 (FastEthernet0/16) of VLAN0010 is forwarding Port path cost 19, Port priority 128, Port Identifier 128.16. Designated root has priority 10, address 001b.d490.7c00 Designated bridge has priority 4106, address 000c.3045.d600 Designated port id is 128.16, designated path cost 38 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 293, received 119 Port 17 (FastEthernet0/17) of VLAN0010 is forwarding Port path cost 19, Port priority 128, Port Identifier 128.17. Designated root has priority 10, address 001b.d490.7c00 Designated bridge has priority 4106, address 000c.3045.d600 Designated port id is 128.17, designated path cost 38 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 294, received 118

Copyright © 2008 Internetwork Expert 96

www.INE.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

Port 18 (FastEthernet0/18) of VLAN0010 is forwarding Port path cost 19, Port priority 128, Port Identifier 128.18. Designated root has priority 10, address 001b.d490.7c00 Designated bridge has priority 4106, address 000c.3045.d600 Designated port id is 128.18, designated path cost 38 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 294, received 119 Port 19 (FastEthernet0/19) of VLAN0010 is blocking Port path cost 19, Port priority 128, Port Identifier 128.19. Designated root has priority 10, address 001b.d490.7c00 Designated bridge has priority 32778, address 000c.3045.4180 Designated port id is 128.19, designated path cost 19 Timers: message age 3, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 71, received 1152 Port 20 (FastEthernet0/20) of VLAN0010 is blocking Port path cost 19, Port priority 128, Port Identifier 128.20. Designated root has priority 10, address 001b.d490.7c00 Designated bridge has priority 32778, address 000c.3045.4180 Designated port id is 16.20, designated path cost 19 Timers: message age 2, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 69, received 1152 Port 21 (FastEthernet0/21) of VLAN0010 is learning Port path cost 19, Port priority 128, Port Identifier 128.21. Designated root has priority 10, address 001b.d490.7c00 Designated bridge has priority 32778, address 000c.3045.4180 Designated port id is 0.21, designated path cost 19 Timers: message age 2, forward delay 7, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 70, received 1153

Copyright © 2008 Internetwork Expert 97

www.INE.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

1.21 Tuning STP Convergence Timers
• • • • Configure the switches so that they broadcast Spanning-Tree hello packets every three seconds. When a new port becomes active it should wait twenty seconds before transitioning to the forwarding state. If the switches do not hear a configuration message within ten seconds they should attempt reconfiguration. This configuration should impact all currently active VLANs and any additional VLANs created in the future.

Configuration
SW1: spanning-tree vlan 1-4094 hello-time 3 spanning-tree vlan 1-4094 forward-time 10 spanning-tree vlan 1-4094 max-age 10

Verification
Rack1SW3#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b.d490.7c00 Cost 19 Port 13 (FastEthernet0/13) Hello Time 3 sec Max Age 10 sec Bridge ID

Forward Delay 10 sec

Priority 32778 (priority 32768 sys-id-ext 10) Address 000c.3045.4180 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Role ---Root Altn Altn Desg Desg Desg Sts --FWD BLK BLK FWD FWD FWD Cost --------19 19 19 19 19 19 Prio.Nbr -------128.13 128.14 128.15 128.19 16.20 0.21 Type -------------------------P2p P2p P2p P2p P2p P2p

Interface ---------------Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21

Copyright © 2008 Internetwork Expert 98

www.INE.com

CCIE R&S Lab Workbook Volume I Version 5.0

Bridging & Switching

Note
Downstream devices from the root bridge inherit the timers configured on the root. With a forward delay of 10 seconds configured on SW1 the downstream switches should take 10 seconds in each of the listening and learning phases during convergence. The below timestamps indicate that a new root port was elected at 04:56:40 on SW3 and transitions from blocking to listening. 10 seconds later, at 04:56:50, the port transitions from listening to learning. Finally 10 seconds after that, at 04:57:00, the port transitions into forwarding.

Rack1SW3#debug spanning-tree events Spanning Tree event debugging is on Rack1SW3#conf t Enter configuration commands, one per line. Rack1SW3(config)#service timestamps log Rack1SW3(config)#logging console 7 Rack1SW3(config)#interface fa0/13 Rack1SW3(config-if)#shut 04:56:40: STP: VLAN0001 04:56:40: STP: VLAN0001 04:56:40: STP: VLAN0005 04:56:40: STP: VLAN0005 <output omitted> 04:56:43: STP: VLAN0001 04:56:43: STP: VLAN0005 <output omitted> 04:56:50: STP: VLAN0001 04:56:50: STP: VLAN0005 <output omitted> 04:57:00: STP: VLAN0001 04:57:00: STP: VLAN0001 04:57:00: STP: VLAN0005 04:57:00: STP: VLAN0005 <output omitted>

End with CNTL/Z.

new root port Fa0/14, cost 19 Fa0/14 -> listening new root port Fa0/14, cost 19 Fa0/14 -> listening sent Topology Change Notice on Fa0/14 sent Topology Change Notice on Fa0/14 Fa0/14 -> learning Fa0/14 -> learning sent Topology Change Notice on Fa0/14 Fa0/14 -> forwarding sent Topology Change Notice on Fa0/14 Fa0/14 -> forwarding

Copyright © 2008 Internetwork Expert 99

www.INE.com

com .22 STP PortFast • Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding. • Configuration SW1: interface FastEthernet0/1 spanning-tree portfast ! interface FastEthernet0/5 spanning-tree portfast SW2: interface FastEthernet0/2 spanning-tree portfast ! interface FastEthernet0/4 spanning-tree portfast ! interface FastEthernet0/6 spanning-tree portfast trunk ! interface FastEthernet0/24 spanning-tree portfast SW3: interface FastEthernet0/5 spanning-tree portfast ! interface FastEthernet0/24 spanning-tree portfast SW4: interface FastEthernet0/4 spanning-tree portfast Copyright © 2008 Internetwork Expert 100 www. Do not use any global Spanning-Tree commands to accomplish this.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching 1.INE.

changed state to administratively down 05:08:44: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1. one per line.com . changed state to up Rack1SW1(config-if)#end Rack1SW1# Copyright © 2008 Internetwork Expert 101 www. and transition immediately to forwarding. also called the forwarding delay. changed state to up 05:08:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1. Rack1SW1(config)#service timestamp log Rack1SW1(config)#logging console 7 Rack1SW1(config)#interface fa0/1 Rack1SW1(config-if)#shutdown 05:08:43: %LINK-5-CHANGED: Interface FastEthernet0/1. End with CNTL/Z. Rack1SW1#show spanning-tree interface fa0/1 portfast VLAN0146 enabled Rack1SW1#debug spanning-tree event Spanning Tree event debugging is on Rack1SW1#conf t Enter configuration commands. changed state to down When interface Fa0/1 is shutdown and subsequently brought back up it immediately transitions to the forwarding state.INE. Rack1SW1(config-if)#no shutdown Rack1SW1(config-if)# 05:08:52: set portid: VLAN0146 Fa0/1: new port id 8003 05:08:52: STP: VLAN0146 Fa0/1 ->jump to forwarding from blocking Rack1SW1(config-if)# 05:08:53: %LINK-3-UPDOWN: Interface FastEthernet0/1.CCIE R&S Lab Workbook Volume I Version 5.0 Verification Bridging & Switching Note Portfast is used to override the listening and learning phases of spanning-tree.

23 STP PortFast Default • • Remove the previous PortFast configuration. Do not use any interface level Spanning-Tree commands to accomplish this.INE. • Configuration SW1: spanning-tree portfast default SW2: spanning-tree portfast default SW3: spanning-tree portfast default SW4: spanning-tree portfast default Copyright © 2008 Internetwork Expert 102 www. Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding.com .CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching 1.

Current configuration : 61 bytes ! interface FastEthernet0/1 switchport access vlan 146 end Rack1SW1#show spanning-tree interface fa0/1 portfast VLAN0146 enabled Rack1SW1#debug spanning-tree event Spanning Tree event debugging is on Rack1SW1#conf t Enter configuration commands.. however it is automatically enabled on all interfaces at the same time.INE. Rack1SW1#show run interface fa0/1 Building configuration. This command is the equivalent of issuing the spanning-tree portfast command under an interface range that encompasses all interfaces. changed state to up 05:14:04: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1. Rack1SW1(config)#interface fa0/1 Rack1SW1(config-if)#shutdown Rack1SW1(config-if)# 05:13:55: %LINK-5-CHANGED: Interface FastEthernet0/1. End with CNTL/Z.0 Verification Bridging & Switching Note Portfast default has the same affect as the interface level portfast command.. one per line. changed state to administratively down 05:13:56: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.CCIE R&S Lab Workbook Volume I Version 5.com . changed state to up Rack1SW1(config-if)# Copyright © 2008 Internetwork Expert 103 www. changed state to down Rack1SW1(config-if)#no shutdown Rack1SW1(config-if)# 05:14:03: set portid: VLAN0146 Fa0/1: new port id 8003 05:14:03: STP: VLAN0146 Fa0/1 ->jump to forwarding from blocking Rack1SW1(config-if)# 05:14:03: %LINK-3-UPDOWN: Interface FastEthernet0/1.

16 128.24 STP UplinkFast • Configure SW2.Nbr -------128. • Configuration SW2: spanning-tree uplinkfast SW3: spanning-tree uplinkfast SW4: spanning-tree uplinkfast Verification Note The Cisco proprietary UplinkFast feature is used to speed up convergence time when the direct failure of the local root port occurs.22 128. Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b.com .d490.21 128.INE.23 Type -------------------------P2p P2p P2p P2p P2p P2p P2p Copyright © 2008 Internetwork Expert 104 www.17 128.0 Bridging & Switching 1. In this particular design interface Fa0/13 on SW2 is the current root port. and SW4 with Spanning-Tree UplinkFast such that if their root port is lost they immediately reconverge to an alternate connection to their upstream bridge.8 128.CCIE R&S Lab Workbook Volume I Version 5.15 128.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Uplinkfast enabled Interface ---------------Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Role ---Desg Root Altn Altn Altn Altn Altn Sts --FWD FWD BLK BLK BLK BLK BLK Cost --------3019 4000 4000 4000 3019 3002 3001 Prio. SW3. Verify this by shutting down the root port of SW2.d4df.7c00 Cost 4000 Port 15 (FastEthernet0/13) Hello Time 3 sec Max Age 10 sec Bridge ID Forward Delay 10 sec Priority 49162 (priority 49152 sys-id-ext 10) Address 001b.

cost 4000 05:16:42: STP: VLAN0009 new root port Fa0/14.0 Bridging & Switching With the failure of the root port the next alternate port is immediately transitioned to the root port in forwarding state. cost 4000 05:16:42: STP: VLAN0079 new root port Fa0/14.CCIE R&S Lab Workbook Volume I Version 5.com . one per line. cost 4000 05:16:42: STP: VLAN0146 new root port Fa0/14. cost 4000 05:16:42: %SPANTREE_FAST-7-PORT_FWD_UPLINK: VLAN0001 FastEthernet0/14 moved to Forwarding (UplinkFast).INE. cost 4000 05:16:42: STP: VLAN0010 new root port Fa0/14. cost 4000 05:16:42: STP: VLAN0067 new root port Fa0/14. cost 4000 05:16:42: STP: VLAN0043 new root port Fa0/14. cost 4000 05:16:42: STP: VLAN0007 new root port Fa0/14. Rack1SW2(config)#service timestamp log Rack1SW2(config)#logging console 7 Rack1SW2(config)#interface fa0/13 Rack1SW2(config-if)#shut Rack1SW2(config-if)# 05:16:42: STP: VLAN0001 new root port Fa0/14. Rack1SW2#debug spanning-tree event Spanning Tree event debugging is on Rack1SW2#conf t Enter configuration commands. and the CAM table is flooded out this new root port to expedite the learning phase of upstream neighbors. cost 4000 05:16:42: STP: VLAN0058 new root port Fa0/14. 05:16:42: STP: VLAN0005 new root port Fa0/14. changed state to down 05:16:45: STP: VLAN0001 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0005 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0007 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0008 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0009 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0010 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0022 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0043 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0058 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0067 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0079 sent Topology Change Notice on Fa0/14 05:16:45: STP: VLAN0146 sent Topology Change Notice on Fa0/14 05:16:58: %SYS-5-CONFIG_I: Configured from console by console Copyright © 2008 Internetwork Expert 105 www. End with CNTL/Z. cost 4000 05:16:42: STP: VLAN0008 new root port Fa0/14. cost 4000 05:16:42: STP: VLAN0022 new root port Fa0/14. changed state to administratively down 05:16:45: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13. cost 4000 05:16:44: %LINK-5-CHANGED: Interface FastEthernet0/13.

d490.d4df.INE.17 128.Nbr -------128.25 STP BackboneFast • Configure Spanning-Tree BackboneFast such that if the links between SW3 and SW4 go down SW2 immediately expires its maxage timer and begins Spanning-Tree reconvergence.com .0 Bridging & Switching 1.CCIE R&S Lab Workbook Volume I Version 5.23 Type -------------------------P2p P2p P2p P2p P2p P2p P2p Interface ---------------Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Copyright © 2008 Internetwork Expert 106 www.16 128. Rack1SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 10 Address 001b.21 128.7c00 Cost 39 Port 23 (FastEthernet0/21) Hello Time 3 sec Max Age 10 sec Bridge ID Forward Delay 10 sec Priority 32778 (priority 32768 sys-id-ext 10) Address 001b. In this design SW2’s root port is towards SW4 on Fa0/21.22 128.15 128.ec80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 10 Role ---Desg Altn Altn Altn Altn Altn Root Sts --FWD BLK BLK BLK BLK BLK FWD Cost --------19 1000 1000 1000 19 2 1 Prio.8 128. Configuration SW1: spanning-tree backbonefast SW2: spanning-tree backbonefast SW3: spanning-tree backbonefast SW4: spanning-tree backbonefast Verification Note The Cisco proprietary BackboneFast feature is used to speed up convergence when an indirect failure occurs upstream in the network by immediately expiring the max_age timer.

STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/13 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/14 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/15 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/21 Vlan1 STP FAST: received inferior BPDU on VLAN0001 FastEthernet0/21.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching SW4 loses its path to the root bridge causing it to send inferior BPDUs downstream to SW2. STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/13 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/14 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/15 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/20 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/21 Vlan1 STP FAST: received inferior BPDU on VLAN0001 FastEthernet0/20. End with CNTL/Z.INE. STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/13 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/14 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/15 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/21 Vlan5 STP FAST: received inferior BPDU on VLAN0005 FastEthernet0/21. SW2 generates Root Link Query (RLQ) PDUs to check if it should expire max_age for its current BPDUs and begin reconvergence. STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/13 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/14 Vlan1 STP FAST: sending RLQ request PDU on VLAN0001(1) Fa0/15 Vlan1 STP FAST: received inferior BPDU on VLAN0005 FastEthernet0/19. STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/13 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/14 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/15 Vlan5 <output omitted> Copyright © 2008 Internetwork Expert 107 www. Since BackboneFast is enabled. one per line. STP FAST: sending RLQ request PDU on VLAN0005(5) Faa0/13 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/14 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/15 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/20 Vlan5 STP FAST: sending RLQ request PDU on VLAN0005(5) Fa0/21 Vlan5 STP FAST: received inferior BPDU on VLAN0005 FastEthernet0/20. Rack1SW4#conf t Enter configuration commands.com . Rack1SW4(config)#interface range fa0/19 – 21 Rack1SW4(config-if)#shutdown Rack1SW4(config-if)# Rack1SW2#debug spanning-tree backbonefast Spanning Tree backbonefast general debugging is on Rack1SW2# STP FAST: received inferior BPDU on VLAN0001 FastEthernet0/19.

0 Bridging & Switching 1.26 STP BPDU Guard • Configure Spanning-Tree BPDU Guard on the switches so that ports connected to the internal and external routers are disabled if a SpanningTree BPDU is detected. Once disabled the switches should attempt to re-enable the ports after two minutes.com .INE. Do not use the global portfast command to accomplish this. • • Configuration SW1: interface FastEthernet0/1 spanning-tree bpduguard enable ! interface FastEthernet0/5 spanning-tree bpduguard enable ! errdisable recovery cause bpduguard errdisable recovery interval 120 SW2: interface FastEthernet0/2 spanning-tree bpduguard enable ! interface FastEthernet0/4 spanning-tree bpduguard enable ! interface FastEthernet0/6 spanning-tree bpduguard enable ! interface FastEthernet0/24 spanning-tree bpduguard enable ! errdisable recovery cause bpduguard errdisable recovery interval 120 SW3: interface FastEthernet0/5 spanning-tree bpduguard enable ! interface FastEthernet0/24 spanning-tree bpduguard enable ! errdisable recovery cause bpduguard errdisable recovery interval 120 SW4: interface FastEthernet0/4 spanning-tree bpduguard enable ! errdisable recovery cause bpduguard errdisable recovery interval 120 Copyright © 2008 Internetwork Expert 108 www.CCIE R&S Lab Workbook Volume I Version 5.

CCIE R&S Lab Workbook Volume I Version 5. Rack1R1#conf t Enter configuration commands. Designated root has priority 146. If configured. Port priority 128.d490. putting Fa0/1 in err-disable state 09:00:10: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1. address 001b.com . for example. one per line.7c00 Designated port id is 128. This ensures that unauthorized switches cannot be plugged into the network.7c00 Designated bridge has priority 146. Disabling port. Disabling port. address 001b. Rack1SW1#show spanning-tree interface fa0/1 detail Port 3 (FastEthernet0/1) of VLAN0146 is forwarding Port path cost 19. Port Identifier 128.0 Verification Bridging & Switching Note The STP BPDU Guard feature is used to enforce access layer security on the termination of the STP domain. changed state to down 09:02:09: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Fa0/1 09:02:12: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/1 with BPDU Guard enabled. to perform a layer 2 man-in-the-middle (MiM) attack.INE. designated path cost 0 Timers: message age 0. 09:00:09: %PM-4-ERR_DISABLE: bpduguard error detected on Fa0/1. forward delay 0. When an interface running BPDU Guard receives a BPDU (STP packet). hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Bpdu guard is enabled BPDU: sent 4500. 09:02:12: %PM-4-ERR_DISABLE: bpduguard error detected on Fa0/1. received 0 Rack1SW1# 09:00:09: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/1 with BPDU Guard enabled.3. STP BPDUs are generated and the link is sent to err-disable state.d490.3. putting Fa0/1 in err-disable state Rack1SW1#show interface fa0/1 status Port Fa0/1 Name Status Vlan err-disabled 146 Duplex auto Speed Type auto 10/100BaseTX Copyright © 2008 Internetwork Expert 109 www. Rack1R1(config)#bridge 1 protocol ieee Rack1R1(config)#interface fa0/0 Rack1R1(config-if)#bridge-group 1 End with CNTL/Z. By configuring bridging on R1’s link to SW1. the errdisable recovery feature can then be used to bring the interface out of err-disable state automatically after a configured interval. the interface is transitioned into err-disable state.

0 Bridging & Switching 1. Rack1SW1# 09:07:57: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/1 with BPDU Guard enabled.com . Disabling port.INE. one per line. changed state to down Copyright © 2008 Internetwork Expert 110 www. • • Configuration SW1: spanning-tree portfast bpduguard default spanning-tree portfast default SW2: spanning-tree portfast bpduguard default spanning-tree portfast default SW3: spanning-tree portfast bpduguard default spanning-tree portfast default SW4: spanning-tree portfast bpduguard default spanning-tree portfast default Verification Note The BPDU Guard default feature works in conjunction with Portfast default in order to automatically enable BPDU Guard on any interfaces in the Portfast state. Do not use any interface level Spanning-Tree commands to accomplish this. Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding. Rack1R1#conf t Enter configuration commands. putting Fa0/1 in err-disable state 09:07:57: %LINK-3-UPDOWN: Interface FastEthernet0/1. Rack1R1(config)#bridge 1 protocol ieee Rack1R1(config)#interface fa0/0 Rack1R1(config-if)#bridge-group 1 End with CNTL/Z. Configure Spanning-Tree BPDU Guard so that if a Spanning-Tree BPDU is detected on any of these ports they are disabled.CCIE R&S Lab Workbook Volume I Version 5.27 STP BPDU Guard Default • • Remove the previous BPDU Guard configuration. 09:07:57: %PM-4-ERR_DISABLE: bpduguard error detected on Fa0/1.

Configuration SW1: interface FastEthernet0/1 spanning-tree bpdufilter enable ! interface FastEthernet0/5 spanning-tree bpdufilter enable SW2: interface FastEthernet0/2 spanning-tree bpdufilter enable ! interface FastEthernet0/4 spanning-tree bpdufilter enable ! interface FastEthernet0/6 spanning-tree bpdufilter enable ! interface FastEthernet0/24 spanning-tree bpdufilter enable SW3: interface FastEthernet0/5 spanning-tree bpdufilter enable ! interface FastEthernet0/24 spanning-tree bpdufilter enable SW4: interface FastEthernet0/4 spanning-tree bpdufilter enable Copyright © 2008 Internetwork Expert 111 www. Configure the switches so that ports connected to the internal and external routers do not send Spanning-Tree packets sent out them. Do not use any global Spanning-Tree commands to accomplish this.28 STP BPDU Filter • • • Remove the previous BPDU Guard configuration.INE.0 Bridging & Switching 1.com .CCIE R&S Lab Workbook Volume I Version 5.

address 0011. forward delay 10.bbbd. max age 20. Rack1R1#show spanning-tree 1 Bridge group 1 is executing the ieee compatible Spanning Tree protocol Bridge Identifier has priority 1. topology change 35.bbbd. Unlike BPDU Guard the interface does not go into err-disable when a violation occurs. received 0 Copyright © 2008 Internetwork Expert 112 www. forward delay 15 We are the root of the spanning tree Topology change flag set. notification 0. Designated root has priority 1.4. detected flag set Number of topology changes 3 last change occurred 00:00:23 ago from FastEthernet0/0 Times: hold 1. is used to terminate the STP domain. like the BPDU Guard feature. designated path cost 0 Timers: message age 0.0 Verification Bridging & Switching Note The BPDU Filter feature.3bc0 Designated port id is 128. aging 15 Port 4 (FastEthernet0/0) of Bridge group 1 is listening Port path cost 19. one per line.3bc0 Designated bridge has priority 1. hold 0 Number of transitions to forwarding state: 0 BPDU: sent 2. Rack1R1(config)#bridge 1 protocol ieee Rack1R1(config)#interface fa0/0 Rack1R1(config-if)#bridge-group 1 Rack1R1(config-if)#end End with CNTL/Z. address 0011. forward delay 15 Timers: hello 0.bbbd.com . address 0011. max age 20. The difference between them is that when configured at the interface level the BPDU Filter feature drops all inbound BPDUs and does not send BPDUs out the interface.INE. R1 is configured to bridge on the Fa0/0 interface and 2 BPDUs are sent. Port priority 128.4.3bc0 Configured hello time 2.CCIE R&S Lab Workbook Volume I Version 5. Port Identifier 128. Other user traffic will continued to be forwarded inbound and outbound the port. Rack1R1#conf t Enter configuration commands. topology change 12. notification 2 hello 2.

hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Bpdu filter is enabled BPDU: sent 0.3.7c00 Designated bridge has priority 146. Designated root has priority 146.7c00 Designated port id is 128.d490.0 Bridging & Switching SW1 does not acknowledge that it received these BPDUs because BPDU Filter is configured.com . address 001b. received 0 Copyright © 2008 Internetwork Expert 113 www. designated path cost 0 Timers: message age 0.CCIE R&S Lab Workbook Volume I Version 5. Rack1SW1#show spanning-tree interface fa0/1 detail Port 3 (FastEthernet0/1) of VLAN0146 is forwarding Port path cost 19.d490. Port priority 128.INE.3. forward delay 0. address 001b. Port Identifier 128.

Do not use any interface level Spanning-Tree commands to accomplish this. Configure Spanning-Tree BPDU Filter on the switches so that the PortFast enabled ports are reverted out of PortFast state if a Spanning-Tree packet is received in them. • • Configuration SW1: spanning-tree portfast bpdufilter default spanning-tree portfast default SW2: spanning-tree portfast bpdufilter default spanning-tree portfast default SW3: spanning-tree portfast bpdufilter default spanning-tree portfast default SW4: spanning-tree portfast bpdufilter default spanning-tree portfast default Copyright © 2008 Internetwork Expert 114 www. Configure Spanning-Tree PortFast on the switches so that ports connected to the internal and external routers do not have to wait for the Spanning-Tree listening and learning phases to begin forwarding.CCIE R&S Lab Workbook Volume I Version 5.com .INE.0 Bridging & Switching 1.29 STP BPDU Filter Default • • Remove the previous BPDU Filter configuration.

When both features are configured together all interfaces run in Portfast mode except those which are receiving BPDUs. Note that the interface can still forward traffic and is not sent into err-disable state.0 Verification Bridging & Switching Note BPDU Filter Default works with Portfast default by allowing interfaces that should not have Portfast enabled on them to be automatically detected. one per line. Once bridging is enabled on R1’s link to SW1.CCIE R&S Lab Workbook Volume I Version 5. Rack1SW1#show spanning-tree interface fa0/1 portfast VLAN0146 enabled Rack1R1#config t Enter configuration commands. Rack1SW1#show spanning-tree interface fa0/1 portfast VLAN0146 disabled Copyright © 2008 Internetwork Expert 115 www.INE. In the below output we can see that Portfast is enabled on SW1’s link Fa0/1 to R1. Rack1R1(config)#bridge 1 protocol ieee Rack1R1(config)#interface fa0/0 Rack1R1(config-if)#bridge-group 1 Rack1R1(config-if)#end Rack1R1# End with CNTL/Z.com . SW1 detects that R1 is sending BPDUs and reverts the interface out of Portfast state.

SW3. Configuration SW1: interface FastEthernet0/13 spanning-tree guard root ! interface FastEthernet0/14 spanning-tree guard root ! interface FastEthernet0/15 spanning-tree guard root ! interface FastEthernet0/16 spanning-tree guard root ! interface FastEthernet0/17 spanning-tree guard root ! interface FastEthernet0/18 spanning-tree guard root Copyright © 2008 Internetwork Expert 116 www.0 Bridging & Switching 1.CCIE R&S Lab Workbook Volume I Version 5.com .INE.30 STP Root Guard • Configure SW1 so that the links to either SW2 or SW3 are disabled if SW2. or SW4 is elected the Spanning-Tree Root Bridge for any VLAN.

15 128. Rack1SW4#conf t Enter configuration commands.d490.d490.--------FWD 19 BKN*19 BKN*19 BKN*19 BKN*19 BKN*19 BKN*19 Prio.17 128.0 Verification Bridging & Switching Note Root Guard is similar to the BPDU Guard feature in the manner that it is used to detect STP packets and disable the interface they were received on. Once SW1 receives these announcements the forwarding of VLAN 1 is disabled on the links that these BPDUs were received.CCIE R&S Lab Workbook Volume I Version 5. End with CNTL/Z.Nbr -------128. Rack1SW4(config)#spanning-tree vlan 1 priority 0 Rack1SW4(config)# Rack1SW1# 09:20:23: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port FastEthernet0/13 on VLAN0001.7 128. one per line.INE.7c00 Hello Time 3 sec Max Age 10 sec Forward Delay 10 sec Aging Time 300 Role ---Desg Desg Desg Desg Desg Desg Desg Sts Cost --.19 128.20 Type -------------------------P2p P2p *ROOT_Inc P2p *ROOT_Inc P2p *ROOT_Inc P2p *ROOT_Inc P2p *ROOT_Inc P2p *ROOT_Inc Interface ---------------Fa0/5 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Copyright © 2008 Internetwork Expert 117 www. Therefore design-wise this feature is used to prevent a rogue device from announcing itself as the new root bridge and possibly implementing a layer 2 man-in-the-middle attack. The difference between them is that with Root Guard the interface is only disabled (via root inconsistent state) if a superior BPDU is received.18 128.com . In the below output SW4 starts announcing superior BPDUs to SW1 by lowering its bridge priority to zero. A superior BPDU indicates a better cost to the root bridge than what is currently installed. Rack1SW1#show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 1 Address 001b.7c00 This bridge is the root Hello Time 3 sec Max Age 10 sec Bridge ID Forward Delay 10 sec Priority 1 (priority 0 sys-id-ext 1) Address 001b.16 128.

31 STP Loop Guard • Configure Spanning-Tree Loop Guard to prevent unidirectional links from forming on any of the inter-switch links in the layer 2 network. Configuration SW1: interface FastEthernet0/13 spanning-tree guard loop ! interface FastEthernet0/14 spanning-tree guard loop ! interface FastEthernet0/15 spanning-tree guard loop ! interface FastEthernet0/16 spanning-tree guard loop ! interface FastEthernet0/17 spanning-tree guard loop ! interface FastEthernet0/18 spanning-tree guard loop SW2: interface FastEthernet0/13 spanning-tree guard loop ! interface FastEthernet0/14 spanning-tree guard loop ! interface FastEthernet0/15 spanning-tree guard loop ! interface FastEthernet0/19 spanning-tree guard loop ! interface FastEthernet0/20 spanning-tree guard loop ! interface FastEthernet0/21 spanning-tree guard loop SW3: interface FastEthernet0/13 spanning-tree guard loop ! interface FastEthernet0/14 spanning-tree guard loop ! interface FastEthernet0/15 spanning-tree guard loop ! interface FastEthernet0/19 Copyright © 2008 Internetwork Expert 118 www.com .INE.0 Bridging & Switching 1.CCIE R&S Lab Workbook Volume I Version 5.

0 spanning-tree guard loop ! interface FastEthernet0/20 spanning-tree guard loop ! interface FastEthernet0/21 spanning-tree guard loop SW4: interface FastEthernet0/16 spanning-tree guard loop ! interface FastEthernet0/17 spanning-tree guard loop ! interface FastEthernet0/18 spanning-tree guard loop ! interface FastEthernet0/19 spanning-tree guard loop ! interface FastEthernet0/20 spanning-tree guard loop ! interface FastEthernet0/21 spanning-tree guard loop Bridging & Switching Copyright © 2008 Internetwork Expert 119 www.INE.com .CCIE R&S Lab Workbook Volume I Version 5.

Specifically this can happen if there is a unidirectional link and the blocking port stops receiving the BPDUs that the designated port it sending. designated path cost 0 Timers: message age 0. Port priority 128. Port Identifier 128. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Loop guard is enabled on the port BPDU: sent 268. received 0 <ouput omitted> Copyright © 2008 Internetwork Expert 120 www. Designated root has priority 1.CCIE R&S Lab Workbook Volume I Version 5.com .15.15. address 001b.d490. In normal STP operation in a redundant topology some links will be designated forwarding while the other end will be blocking. Designated root has priority 5. but it uses STP BPDU keepalives to determine if there is a unidirectional link.d490.7c00 Designated port id is 128. If one of these blocking links transitions to forwarding state erroneously. Port priority 128. received 109 Port 15 (FastEthernet0/13) of VLAN0005 is forwarding Port path cost 19.0 Verification Bridging & Switching Note STP Loop Guard is used to prevent STP loops from occurring due to unidirectional links. hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Loop guard is enabled on the port BPDU: sent 193.7c00 Designated port id is 128.15. Port Identifier 128.15.7c00 Designated bridge has priority 1. address 001b. This feature is similar to Unidirectional Link Detection (UDLD). address 001b. address 001b. a loop can occur. forward delay 0. Rack1SW1#show spanning-tree interface fa0/13 detail Port 15 (FastEthernet0/13) of VLAN0001 is blocking Port path cost 19. forward delay 0.INE. Loop guard prevents this by transitioning blocking ports into loop-inconsistent state instead of forwarding if BPDUs stop being received from the designated port.d490. designated path cost 0 Timers: message age 0.7c00 Designated bridge has priority 5.d490.

com .INE.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching 1.32 Unidirectional Link Detection • • Remove the previous Loop Guard configuration. Configuration SW1: interface FastEthernet0/13 udld port aggressive ! interface FastEthernet0/14 udld port aggressive ! interface FastEthernet0/15 udld port aggressive ! interface FastEthernet0/16 udld port aggressive ! interface FastEthernet0/17 udld port aggressive ! interface FastEthernet0/18 udld port aggressive SW2: interface FastEthernet0/13 udld port aggressive ! interface FastEthernet0/14 udld port aggressive ! interface FastEthernet0/15 udld port aggressive ! interface FastEthernet0/19 udld port aggressive ! interface FastEthernet0/20 udld port aggressive ! interface FastEthernet0/21 udld port aggressive SW3: interface FastEthernet0/13 udld port aggressive ! interface FastEthernet0/14 udld port aggressive ! interface FastEthernet0/15 udld port aggressive Copyright © 2008 Internetwork Expert 121 www. Configure UDLD to prevent unidirectional links from forming on any of the inter-switch links in the layer 2 network.

0 ! interface FastEthernet0/19 udld port aggressive ! interface FastEthernet0/20 udld port aggressive ! interface FastEthernet0/21 udld port aggressive SW4: interface FastEthernet0/16 udld port aggressive ! interface FastEthernet0/17 udld port aggressive ! interface FastEthernet0/18 udld port aggressive ! interface FastEthernet0/19 udld port aggressive ! interface FastEthernet0/20 udld port aggressive ! interface FastEthernet0/21 udld port aggressive Bridging & Switching Copyright © 2008 Internetwork Expert 122 www.CCIE R&S Lab Workbook Volume I Version 5.com .INE.

For example if a loop occurs due to a physical wiring problem. Likewise if there is a unidirectional link due to a failure in the STP software itself. i. someone mistakenly mixes up the send and receive pairs of a fiber link. The difference between the features is that Loop Guard uses STP BPDUs to detect these failures. In “Normal” mode if the physical state of port (as reported by Layer 1) is still up UDLD marks this port as “Undetermined”. UDLD can detect this. like Loop Guard. Additionally a switch echoes back the ID of its neighbor. while UDLD uses its own keepalive. UDLD is a Cisco proprietary feature in which peers discover each other by exchanging frames sent to the well-known MAC address 01:00:0C:CC:CC:CC.e. Loop Guard can detect this but UDLD cannot. If UDLD is set to “Aggressive” mode. once the switch loses its neighbor it actively tries to re-establish the relationship by sending a UDLD frames 8 times every 1 second. This mode of operation is informational and potentially less disruptive (though it does not prevent STP loops). What happens next depends on UDLD mode of operation.0 Verification Bridging & Switching Note UDLD.INE.com . and UDLD can not. In certain designs there are unidirectional links that Loop Guard can prevent. is used to prevent loops due to unidirectional links. If no echo frame with the switch’s own ID has been seen from the peer for a certain amount of time. Based on this the features can be configured at the same time to protect against all possible unidirectional link scenarios. If the neighbor does not respond after that the port is considered to be unidirectional and sent to err-disable state.CCIE R&S Lab Workbook Volume I Version 5. Each switch sends its own device ID along with the originator port ID and timeout value to its peer. but does NOT shut down or disable the port. and likewise ones that UDLD can prevent. Copyright © 2008 Internetwork Expert 123 www. although much more rare. but Loop Guard cannot. and it continues to operate under its current STP status. the port is suspected to be unidirectional. but Loop Guard cannot.

Instead UDLD is more commonly run on Fiber Optic interfaces.INE.0 Bridging & Switching Although in this design UDLD is configured on copper UTP interfaces. this case is usually not needed in a real network design due to the Fast Link Pulse (FLP) signals that already track the interface status on wired interfaces. Rack1SW1#show udld fa0/13 Interface Fa0/13 --Port enable administrative configuration setting: Enabled / in aggressive mode Port enable operational state: Enabled / in aggressive mode Current bidirectional state: Bidirectional Current operational state: Advertisement .CCIE R&S Lab Workbook Volume I Version 5.Single neighbor detected Message interval: 7 Time out interval: 5 Entry 1 --Expiration time: 45 Device ID: 1 Current neighbor state: Bidirectional Device name: FDO1118Z0P9 Port ID: Fa0/13 Neighbor echo 1 device: FDO1118Z0P6 Neighbor echo 1 port: Fa0/13 Message interval: 15 Time out interval: 5 CDP Device name: Rack1SW2 Copyright © 2008 Internetwork Expert 124 www.com .

255.0 SW1: vtp domain CCIE vtp mode client ! spanning-tree mst configuration name MST1 revision 1 instance 1 vlan 1-100 instance 2 vlan 101-200 instance 3 vlan 201-4094 ! spanning-tree mst 1 priority 0 ! spanning-tree mode mst ! interface FastEthernet0/1 switchport access vlan 146 ! Copyright © 2008 Internetwork Expert 125 www.0 Bridging & Switching 1. Instance 2 should service VLANs 101 .1q trunk links.com .200. SW1 & SW3.255.6 255. SW2 & SW4. Disable all other inter-switch links.0 ! interface FastEthernet0/0.67. and SW3 & SW4 as 802.6 255.100. Configure SW4 as a VTP server using the domain name CCIE with SW1. Configuration R6: interface FastEthernet0/0.33 MST Root Bridge Election • • • • • • • • • • • • Configure the inter-switch links between SW1 & SW2. If SW1 goes down SW2 should take over as the STP Root Bridge for instance 1.255. Configure SW1 as the STP Root Bridge for instance 1.1.146 encapsulation dot1q 146 ip address 155. Instance 3 should service all other VLANs. and SW3 as its clients. Configure Multiple Spanning-Tree on the switches. SW2. Instance 1 should service VLANs 1 . Configure VLAN assignments per the diagram.INE. If SW4 goes down SW3 should take over as the STP Root Bridge for instance 2.CCIE R&S Lab Workbook Volume I Version 5.1. Configure SW4 as the STP Root Bridge for instance 2.67 encapsulation dot1q 67 ip address 155.255.146.

0 interface FastEthernet0/5 switchport access vlan 58 ! interface FastEthernet0/13 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/14 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/15 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/16 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/17 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/18 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/19 shutdown ! interface FastEthernet0/20 shutdown ! interface FastEthernet0/21 shutdown Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q SW2: vtp domain CCIE vtp mode client ! spanning-tree mst configuration name MST1 revision 1 instance 1 vlan 1-100 instance 2 vlan 101-200 instance 3 vlan 201-4094 ! spanning-tree mst 1 priority 4096 ! spanning-tree mode mst ! interface FastEthernet0/2 switchport access vlan 22 ! interface FastEthernet0/4 switchport access vlan 43 ! Copyright © 2008 Internetwork Expert 126 www.INE.com .CCIE R&S Lab Workbook Volume I Version 5.

com .CCIE R&S Lab Workbook Volume I Version 5.0 interface FastEthernet0/6 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/13 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/14 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/15 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/16 shutdown ! interface FastEthernet0/17 shutdown ! interface FastEthernet0/18 shutdown ! interface FastEthernet0/19 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/20 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/21 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/24 switchport access vlan 22 Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q dot1q SW3: vtp domain CCIE vtp mode client ! spanning-tree mst configuration name MST1 revision 1 instance 1 vlan 1-100 instance 2 vlan 101-200 instance 3 vlan 201-4094 ! spanning-tree mst 2 priority 4096 ! spanning-tree mode mst ! interface FastEthernet0/5 switchport access vlan 5 Copyright © 2008 Internetwork Expert 127 www.INE.

146 ! spanning-tree mst configuration name MST1 revision 1 instance 1 vlan 1-100 instance 2 vlan 101-200 instance 3 vlan 201-4094 ! spanning-tree mst 2 priority 0 ! spanning-tree mode mst ! interface FastEthernet0/4 switchport access vlan 146 ! interface FastEthernet0/13 shutdown ! interface FastEthernet0/14 shutdown Copyright © 2008 Internetwork Expert 128 www.8.58.7.com .0 ! interface FastEthernet0/13 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/14 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/15 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/16 shutdown ! interface FastEthernet0/17 shutdown ! interface FastEthernet0/18 shutdown ! interface FastEthernet0/19 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/20 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/21 switchport trunk encapsulation switchport mode trunk Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q SW4: vtp domain CCIE vlan 5.67.10.INE.CCIE R&S Lab Workbook Volume I Version 5.22.79.43.9.

and the Cisco extensions to STP. AKA Common Spanning-Tree. With PVST there would be 4094 separate instances of STP. With MST three user-defined instances are created that map different portions of the VLAN space into separate instances with a similar forwarding path. but not all VLANs. follow the same layer 2 forwarding path. while at the same time allowing for flexible failure domain separation and traffic engineering. PVST+.0 ! interface FastEthernet0/15 shutdown ! interface FastEthernet0/16 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/17 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/18 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/19 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/20 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/21 switchport trunk encapsulation switchport mode trunk Bridging & Switching dot1q dot1q dot1q dot1q dot1q dot1q Verification Note Multiple Spanning-Tree (MST) is an IEEE standard defined in 802. and combines them. Unlike the Cisco proprietary Per-VLAN Spanning-Tree (PVST).CCIE R&S Lab Workbook Volume I Version 5.INE. PVST. Rapid PVST+. and allows user-defined STP instances to be mapped to multiple VLANs.com . For example in this design STP instances are created for VLANs 1 – 4094.1s. MST essentially takes the best features of IEEE 802. This has very little overhead but does not allow for detailed traffic engineering. which allows for detailed traffic engineering but creates immense overhead.1D Spanning-Tree. In Common Spanning-Tree all 4094 VLANs would map to one instance. MST can be used to eliminate the overhead of redundant STP instances in topologies where multiple VLANs. Copyright © 2008 Internetwork Expert 129 www.

INE.15 128.0 Bridging & Switching Like CST and PVST.d600 priority port Fa0/16 cost Role ---Desg Altn Altn Altn Root Altn Altn Sts --FWD BLK BLK BLK FWD BLK BLK Cost --------200000 200000 200000 200000 200000 200000 200000 Prio. From the show spanning-tree mst output we can see which VLANs are mapped to the particular MST instance. since there is one STP instance per VLAN.16 128.19 128. In PVST there is one root bridge election per VLAN. and how the root port election has occurred. where as in PVST the sysid is the VLAN number. who the root bridge is.Nbr -------128. MST uses the lowest Bridge-ID (BID) in the network to elect the Root Bridge. The BID is made up of the priority value and the MAC address.17 128. and if there is a tie in priority the lowest MAC address is the tie breaker.20 32770 (32768 sysid 2) 2 (0 sysid 2) 400000 rem hops 18 Interface ---------------Fa0/1 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p Copyright © 2008 Internetwork Expert 130 www. In this case SW1 is the root for instance 1. In MST the sysid field is the instance number. Rack1SW1#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 001b.Nbr -------128. The lower priority wins the election.17 128.7c00 priority address 000c.16 128. which is made up of the configured priority of 0 plus the sytemid extension of 1.18 128.3045.18 128. while SW4 is the root for instance 2.19 128.3 128.20 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p Rack1SW1#show spanning-tree mst 2 ##### MST2 Bridge Root vlans mapped: 101-200 address 001b.com .15 128.CCIE R&S Lab Workbook Volume I Version 5. but in MST there is one election per user-defined instance. SW1 is the root for instance 1 because it has a priority value of 1.d490.7 128.7c00 this switch for MST1 Role ---Desg Desg Desg Desg Desg Desg Desg Sts --FWD FWD FWD FWD FWD FWD FWD Cost --------200000 200000 200000 200000 200000 200000 200000 priority 1 (0 sysid 1) Interface ---------------Fa0/5 Fa0/13 Fa0/14 Fa0/15 Fa0/16 Fa0/17 Fa0/18 Prio.d490.

3045.23 128.d600 priority port Fa0/19 cost Role ---Desg Desg Desg Desg Root Altn Altn Sts --FWD FWD FWD FWD FWD BLK BLK Cost --------200000 200000 200000 200000 200000 200000 200000 Prio.21 128.com .15 128.8 128.d490.Nbr -------128.7c00 port Fa0/13 Role ---Desg Desg Desg Root Altn Altn Desg Desg Desg Desg Sts --FWD FWD FWD FWD BLK BLK FWD FWD FWD FWD Cost --------200000 200000 200000 200000 200000 200000 200000 200000 200000 2000000 Bridging & Switching priority priority cost Prio.8 128.21 128.Nbr -------128.INE.15 128.0 Rack1SW2#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 001b.5 128.17 128.24 32769 (32768 sysid 1) 1 (0 sysid 1) 200000 rem hops 19 Interface ---------------Fa0/5 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Fa0/24 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p Shr Copyright © 2008 Internetwork Expert 131 www.14 128.7c00 port Fa0/13 Role ---Desg Root Altn Altn Desg Desg Desg Desg Sts --FWD FWD BLK BLK FWD FWD FWD FWD Cost --------200000 200000 200000 200000 200000 200000 200000 2000000 priority priority cost Prio.4180 address 001b.22 128.13 128.3045.ec80 priority address 000c.20 128.22 128.d4df.6 128.ec80 address 001b.Nbr -------128.15 128.d4df.23 32770 (32768 sysid 2) 2 (0 sysid 2) 200000 rem hops 19 Interface ---------------Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p Rack1SW3#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 000c.d490.4 128.17 128.CCIE R&S Lab Workbook Volume I Version 5.21 128.19 128.16 128.26 4097 (4096 sysid 1) 1 (0 sysid 1) 200000 rem hops 19 Interface ---------------Fa0/2 Fa0/4 Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Fa0/24 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p P2p P2p Shr Rack1SW2#show spanning-tree mst 2 ##### MST2 Bridge Root vlans mapped: 101-200 address 001b.16 128.

3045.16 128.19 128.Nbr -------128.d600 priority port Fa0/19 cost Role ---Desg Desg Desg Root Altn Altn Sts --FWD FWD FWD FWD BLK BLK Cost --------200000 200000 200000 200000 200000 200000 Prio.13 128.3045.16 128.14 128.17 128.INE.3045.d600 address 001b.15 128.4 128.17 128.18 128.19 128.21 2 (0 sysid 2) Interface ---------------Fa0/4 Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p Copyright © 2008 Internetwork Expert 132 www.21 Bridging & Switching 4098 (4096 sysid 2) 2 (0 sysid 2) 200000 rem hops 19 Interface ---------------Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Type -------------------------------P2p P2p P2p P2p P2p P2p Rack1SW4#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 000c.20 128.3045.20 128.7c00 port Fa0/16 Role ---Root Altn Altn Altn Altn Altn Sts --FWD BLK BLK BLK BLK BLK Cost --------200000 200000 200000 200000 200000 200000 priority priority cost Prio.Nbr -------128.19 128.d490.Nbr -------128.d600 priority this switch for MST2 Role ---Desg Desg Desg Desg Desg Desg Desg Sts --FWD FWD FWD FWD FWD FWD FWD Cost --------200000 200000 200000 200000 200000 200000 200000 Prio.CCIE R&S Lab Workbook Volume I Version 5.0 Rack1SW3#show spanning-tree mst 2 ##### MST2 Bridge Root vlans mapped: 101-200 address 000c.com .20 128.21 32769 (32768 sysid 1) 1 (0 sysid 1) 400000 rem hops 18 Interface ---------------Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Fa0/21 Type -------------------------------P2p P2p P2p P2p P2p P2p Rack1SW4#show spanning-tree mst 2 ##### MST2 Bridge Root vlans mapped: 101-200 address 000c.18 128.4180 priority address 000c.

6 128.23 128. Rack1SW1#conf t Enter configuration commands.26 Type -------------------------------P2p P2p P2p P2p P2p P2p Shr Copyright © 2008 Internetwork Expert 133 www.Nbr -------128.18 Rack1SW1(config-if-range)#shut Rack1SW1(config-if-range)# Rack1SW2#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 001b. When connectivity to SW1 is lost SW2 is promoted to the root bridge status.d4df.8 128.22 128.21 128.CCIE R&S Lab Workbook Volume I Version 5.com .ec80 this switch for MST1 Role ---Desg Desg Desg Desg Desg Desg Desg Sts --BLK BLK BLK FWD FWD FWD BLK Cost --------200000 200000 200000 200000 200000 200000 2000000 priority 4097 (4096 sysid 1) Interface ---------------Fa0/2 Fa0/4 Fa0/6 Fa0/19 Fa0/20 Fa0/21 Fa0/24 Prio.INE. End with CNTL/Z.4 128.0 Bridging & Switching For MST instance 1 SW1 has a priority of 1. one per line. and SW2 is next in line with a priority of 4097. Rack1SW1(config)#interface range fa0/13 .

com .0 Bridging & Switching 1. • Configuration SW2: interface FastEthernet0/13 spanning-tree mst 1 cost 500000 ! interface FastEthernet0/14 spanning-tree mst 1 cost 500000 ! interface FastEthernet0/15 spanning-tree mst 1 cost 500000 ! interface FastEthernet0/20 spanning-tree mst 1 cost 2 ! interface FastEthernet0/21 spanning-tree mst 1 cost 1 Copyright © 2008 Internetwork Expert 134 www.CCIE R&S Lab Workbook Volume I Version 5.34 MST Load Balancing with Port Cost • Using Spanning-Tree cost modify the layer 2 transit network so that traffic for MST instance 1 from SW2 to SW1 uses the last link between SW2 and SW4. If this link goes down traffic should fall over to the second link between SW2 and SW4.INE.

15 128.com .6 128. The show spanning-tree mst command shows the local cost values of the outgoing ports on the local switch.INE.0 Verification Bridging & Switching Note Similar to CST and PVST.26 4097 (4096 sysid 1) 1 (0 sysid 1) 400001 rem hops 17 Interface ---------------Fa0/2 Fa0/4 Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Fa0/21 Fa0/24 Type -------------------------P2p P2p P2p P2p P2p P2p P2p P2p P2p Shr Copyright © 2008 Internetwork Expert 135 www.ec80 address 001b.7c00 port Fa0/21 Role ---Desg Desg Desg Altn Altn Altn Altn Altn Root Desg Sts --FWD FWD FWD BLK BLK BLK BLK BLK FWD FWD Cost --------200000 200000 200000 500000 500000 500000 200000 2 1 2000000 priority priority cost Prio.23 128.d490.8 128. MST uses a cost value derived from the inverse bandwidth of the interface (higher bandwidth means lower cost).22 128.Nbr -------128. Rack1SW2#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 001b.16 128.d4df.17 128. The root port is chosen based on the lowest end-to-end cost to the root bridge.4 128.CCIE R&S Lab Workbook Volume I Version 5.21 128.

forward transitions 3 Bpdus (MRecords) sent 6085.000 to SW4.d490.17 Timers: message expires in 5 sec. which is 200.d490.15 priority 128 cost 500000 Designated root address 001b. Fa0/20 has a total cost of 400. Fa0/20 has a total cost of 600. forward transitions 3 Bpdus (MRecords) sent 1385. forward transitions 0 Bpdus (MRecords) sent 3965.In this output the alternate ports Fa0/13 – Fa0/15 have a total cost of 500.7c00 priority 1 cost 400000 Designated bridge address 000c. forward delay 0. and 200.com .000 from SW3 to SW1.d4df. forward delay 0.16 Timers: message expires in 5 sec.7c00 priority 1 port id 128.000 from SW4 to SW3. plus the local port cost.17 Timers: message expires in 4 sec. forward transitions 5 Bpdus (MRecords) sent 960.7c00 priority 1 cost 400000 Designated bridge address 000c.7c00 priority 1 port id 128. received 1011 FastEthernet0/20 of MST1 is alternate blocking Port info port id 128.18 <output omitted> Copyright © 2008 Internetwork Expert 136 www. forward delay 0.d490. The end-to-end cost is made up of the upstream (designated) cost. and 200.7c00 priority 1 cost 0 Designated bridge address 001b. 200. received 4725 FastEthernet0/19 of MST1 is alternate blocking Port info port id 128.d490.21 priority 128 cost 200000 Designated root address 001b.7c00 port Fa0/21 priority priority cost 4097 (4096 sysid 1) 1 (0 sysid 1) 400001 rem hops 17 <output omitted> FastEthernet0/13 of MST1 is alternate blocking Port info port id 128.d490.d490.000 from SW4 to SW3. received 4719 FastEthernet0/15 of MST1 is alternate blocking Port info port id 128. 200.001.d490.7c00 priority 1 cost 0 Designated bridge address 001b.d600 priority priority priority 128 1 32769 cost cost port id 1 400000 128. forward delay 0.3045.16 priority 128 cost 500000 Designated root address 001b.d490.3045.16 Timers: message expires in 4 sec.CCIE R&S Lab Workbook Volume I Version 5. received 6086 FastEthernet0/21 of MST1 is root forwarding Port info port id 128.7c00 Designated bridge address 000c.7c00 priority 1 cost 0 Designated bridge address 001b.17 priority 128 cost 500000 Designated root address 001b.d490.7c00 priority 1 port id 128. Fa0/21 wins the root port election since it has a total cost of 400.22 priority 128 cost 2 Designated root address 001b.INE.d600 priority 32769 port id 128. forward transitions 0 Bpdus (MRecords) sent 3971.000 from SW3 to SW1.0 Bridging & Switching To see the entire end-to-end cost of a path the show spanning-tree mst detail command should be used. forward delay 0. which is 2 to SW4.000.d600 priority 32769 port id 128. received 844 FastEthernet0/14 of MST1 is alternate blocking Port info port id 128.002.3045.000 due to the manual cost change.15 Timers: message expires in 5 sec.ec80 address 001b.23 Designated root address 001b.d490. Rack1SW2#show spanning-tree mst 1 detail ##### MST1 Bridge Root vlans mapped: 1-100 address 001b.

Nbr -------128. changed state to down Rack1SW2#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 001b.21 128.INE.ec80 address 001b.15 128. End with CNTL/Z.16 128. Rack1SW2#conf t Enter configuration commands.d4df.002 through Fa0/20.CCIE R&S Lab Workbook Volume I Version 5. one per line.d490. Rack1SW2(config)#interface fa0/21 Rack1SW2(config-if)#shut Rack1SW2(config-if)#end Rack1SW2# 07:22:04: %LINK-5-CHANGED: Interface FastEthernet0/21.7c00 port Fa0/20 Role ---Desg Desg Desg Altn Altn Altn Altn Root Sts --BLK BLK BLK BLK BLK BLK BLK FWD Cost --------200000 200000 200000 500000 500000 500000 200000 2 priority priority cost Prio.22 4097 (4096 sysid 1) 1 (0 sysid 1) 400002 rem hops 17 Interface ---------------Fa0/2 Fa0/4 Fa0/6 Fa0/13 Fa0/14 Fa0/15 Fa0/19 Fa0/20 Type -------------------------------P2p P2p P2p P2p P2p P2p P2p P2p Copyright © 2008 Internetwork Expert 137 www.com .6 128. changed state to administratively down 07:22:04: %SYS-5-CONFIG_I: Configured from console by console 07:22:05: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/21.8 128.17 128.4 128.0 Bridging & Switching When SW2’s port Fa0/21 is down the next lowest cost path is 400.

so the below output doesn’t tell us why Fa0/21 is chosen as the root port.20 P2p Fa0/21 Root FWD 200000 128.17 P2p Fa0/18 Altn BLK 200000 128.--.000.com . Set the cost for MST instance 1 on SW3’s links to SW1 to be 100.--------.CCIE R&S Lab Workbook Volume I Version 5.21 P2p Copyright © 2008 Internetwork Expert 138 www.---. The show spanning-tree mst only shows the local portpriority.16 P2p Fa0/17 Altn BLK 200000 128.6d00 priority 1 (0 sysid 1) port Fa0/21 cost 300000 rem hops 18 Interface Role Sts Cost Prio. • Configuration SW3: interface FastEthernet0/13 spanning-tree mst 1 cost 100000 ! interface FastEthernet0/14 spanning-tree mst 1 cost 100000 ! interface FastEthernet0/15 spanning-tree mst 1 cost 100000 ! interface FastEthernet0/20 spanning-tree mst 1 port-priority 16 ! interface FastEthernet0/21 spanning-tree mst 1 port-priority 0 Verification Note Like CST and PVST.fd00 priority 32769 (32768 sysid 1) address 001a.-------.35 MST Load Balancing with Port Priority • • • Remove the previous STP cost modifications.46bf.INE.a20f.Nbr Type ---------------. Using Spanning-Tree priority modify the layer 2 transit network so that traffic for MST instance 1 from SW4 to SW1 uses the last link between SW3 and SW4.19 P2p Fa0/20 Altn BLK 200000 128. Rack1SW4#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 000b. If this link goes down traffic should fall over to the second link between SW3 and SW4.0 Bridging & Switching 1. MST uses the designated (upstream) port-priority as a tie breaker if the end-to-end cost is the same on multiple ports to the same upstream switch.-------------------------------Fa0/16 Altn BLK 200000 128.18 P2p Fa0/19 Altn BLK 200000 128.

forward transitions 1 Bpdus (MRecords) sent 108.20 and Fa0/19’s 128.21.20 Timers: message expires in 5 sec.000 is equal on ports Fa0/19. forward delay 0.6d00 priority 1 cost 100000 Designated bridge address 000d.20 priority 128 cost 200000 Designated root address 001a. forward delay 0. Since all three of these ports share the same designated bridge-id. forward delay 0.7780 priority 4097 port id 128.a256.22 Timers: message expires in 5 sec.21 priority 128 cost 200000 Designated root address 001a. The port-id is made of the port-priority and the internally assigned port number.19.16 priority 128 cost 200000 Designated root address 001a.21 Timers: message expires in 5 sec.a20f. forward transitions 0 Bpdus (MRecords) sent 631.7780 priority 4097 port id 128. forward transitions 1 Bpdus (MRecords) sent 109.fd00 address 001a. received 622 FastEthernet0/21 of MST1 is root forwarding Port info port id 128.46bf. forward delay 0.6d00 priority 1 cost 100000 Designated bridge address 000d.6d00 priority 1 cost 200000 Designated bridge address 001a. Fa0/20.com .653a.a256.653a.17 priority 128 cost 200000 Designated root address 001a. received 688 FastEthernet0/19 of MST1 is alternate blocking Port info port id 128.a20f.2680 priority 32769 port id 128.a20f.a20f.653a.6d00 priority 1 cost 200000 Designated bridge address 001a. received 148 FastEthernet0/17 of MST1 is alternate blocking Port info port id 128. the designated port-id is checked.6d00 priority 1 cost 100000 Designated bridge address 000d.21 Timers: message expires in 5 sec. Rack1SW4#show spanning-tree mst 1 detail ##### MST1 Bridge Root vlans mapped: 1-100 address 000b.2680 priority 32769 port id 16. forward transitions 1 Bpdus (MRecords) sent 599. and Fa0/21.0 Bridging & Switching The show spanning-tree mst detail shows that the lowest end-to-end cost of 300.a256.CCIE R&S Lab Workbook Volume I Version 5. forward delay 0.19 Timers: message expires in 4 sec.a20f. Fa0/21 has the lowest designated port-id of 0. received 203 FastEthernet0/20 of MST1 is alternate blocking Port info port id 128.18 priority 128 cost 200000 Designated root address 001a. received 507 Copyright © 2008 Internetwork Expert 139 www.a20f.6d00 port Fa0/21 priority priority cost 32769 (32768 sysid 1) 1 (0 sysid 1) 300000 rem hops 18 FastEthernet0/16 of MST1 is alternate blocking Port info port id 128. forward transitions 1 Bpdus (MRecords) sent 713.19 priority 128 cost 200000 Designated root address 001a.2680 priority 32769 port id 0. forward transitions 0 Bpdus (MRecords) sent 632.INE. forward delay 0.6d00 priority 1 cost 200000 Designated bridge address 001a.7780 priority 4097 port id 128.a20f. versus Fa0/20’s 16.23 Timers: message expires in 5 sec. received 686 FastEthernet0/18 of MST1 is alternate blocking Port info port id 128.

INE. Rack1SW4#conf t Enter configuration commands.18 128.20.0 Bridging & Switching When SW4 loses its connection to SW3 via Fa0/21 the next port in line is Fa0/20 with the designated port-id of 16.Nbr -------128.20 32769 (32768 sysid 1) 1 (0 sysid 1) 300000 rem hops 18 Interface ---------------Fa0/16 Fa0/17 Fa0/18 Fa0/19 Fa0/20 Type -------------------------------P2p P2p P2p P2p P2p Copyright © 2008 Internetwork Expert 140 www.6d00 port Fa0/20 Role ---Altn Altn Altn Altn Root Sts --BLK BLK BLK BLK FWD Cost --------200000 200000 200000 200000 200000 priority priority cost Prio.fd00 address 001a.a20f. Rack1SW4(config)#interface fa0/21 Rack1SW4(config-if)#shut Rack1SW4(config-if)#end Rack1SW4# 00:20:12: %SYS-5-CONFIG_I: Configured from console by console 00:20:13: %LINK-5-CHANGED: Interface FastEthernet0/21.17 128. changed state to administratively down 00:20:14: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/21.19 128. one per line.16 128. End with CNTL/Z.com . changed state to down Rack1SW4#show spanning-tree mst 1 ##### MST1 Bridge Root vlans mapped: 1-100 address 000b.CCIE R&S Lab Workbook Volume I Version 5.46bf.

Configuration SW1: interface FastEthernet0/1 spanning-tree portfast ! interface FastEthernet0/5 spanning-tree portfast SW2: interface FastEthernet0/2 spanning-tree portfast ! interface FastEthernet0/4 spanning-tree portfast ! interface FastEthernet0/6 spanning-tree portfast trunk ! interface FastEthernet0/24 spanning-tree portfast SW3: interface FastEthernet0/5 spanning-tree portfast ! interface FastEthernet0/24 spanning-tree portfast SW4: interface FastEthernet0/4 spanning-tree portfast Copyright © 2008 Internetwork Expert 141 www.CCIE R&S Lab Workbook Volume I Version 5.INE.0 Bridging & Switching 1.com .36 MST and Rapid Spanning Tree • Configure Rapid Spanning-Tree on the switches so that ports connected to the internal and external routers immediately begin forwarding when enabled.

received 0 Instance -------0 2 Role ---Desg Desg Sts --FWD FWD Cost --------200000 200000 Prio. Rapid Spanning-Tree Protocol (RSTP) is automatically enabled.8 128.1w that speeds up convergence through a reliable handshaking process.Nbr -------128.Nbr -------128.CCIE R&S Lab Workbook Volume I Version 5. received 0 Instance -------0 1 2 Role ---Desg Desg Desg Sts --FWD FWD FWD Cost --------200000 200000 200000 Prio.8 128.3 Vlans mapped ------------------------------none 101-200 (default) (default) (default) Rack1SW2#show spanning-tree mst interface fa0/6 FastEthernet0/6 of MST0 is designated forwarding Edge port: edge (trunk) port guard : none Link type: point-to-point (auto) bpdu filter: disable Boundary : internal bpdu guard : disable Bpdus sent 30. RSTP is an IEEE standard defined in 802.com . Instead a port must be configured as an edge port with the spanning-tree portfast command. However.8 Vlans mapped ------------------------------none 1-100 101-200 (default) (default) (default) Copyright © 2008 Internetwork Expert 142 www. Rack1SW1#show spanning-tree mst interface fa0/1 FastEthernet0/1 of MST0 is designated forwarding Edge port: edge (enable) port guard : none Link type: point-to-point (auto) bpdu filter: disable Boundary : internal bpdu guard : disable Bpdus sent 260. RSTP defines new port “roles” to automatically allow for the functionality built into Cisco proprietary features such as PortFast and UplinkFast.0 Verification Bridging & Switching When MST is enabled.3 128.INE. RSTP “edge” ports behave the same as PVST PortFast enabled ports. in order to maintain backwards compatible configurations Cisco’s implementation of RSTP does not automatically elect edge ports as the standard suggests.

Configuration SW2: interface FastEthernet0/2 switchport protected ! interface FastEthernet0/24 switchport protected Copyright © 2008 Internetwork Expert 143 www. Configure port protection on SW2 so that R2 and BB2 cannot directly communicate with each other.INE.0 Bridging & Switching 1.10. where X is your rack number.X.com .8/24.CCIE R&S Lab Workbook Volume I Version 5.37 Protected Ports • • Create a new SVI for VLAN22 on SW2 and assign it the IP address 192. but can communicate with SW2’s VLAN22 interface.

f1c0 Type ARPA ARPA ARPA Interface FastEthernet0/0 FastEthernet0/0 Copyright © 2008 Internetwork Expert 144 www.1.CCIE R&S Lab Workbook Volume I Version 5.1. timeout is 2 seconds: .com ..1.0 Verification Bridging & Switching Note Protected ports are used to prevent traffic from being exchanged at layer 2 between two or more ports that are in the same VLAN.10.INE.10. 100-byte ICMP Echos to 192. This feature is a much smaller subset of the Private VLAN feature.10.65c2. Success rate is 0 percent (0/5) Rack1R2#ping 192.10.8. 100-byte ICMP Echos to 192.1.8 Type escape sequence to abort.10. and cannot span between multiple physical switches.254.77c3 000d. 100-byte ICMP Echos to 192.2 Type escape sequence to abort. Sending 5.254.10.2. however traffic received in a protected port can be sent out a non-protected port. but R2 and BB2 cannot.1.. round-trip min/avg/max = 1/2/8 ms Rack1SW2#ping 192.1.1. Sending 5.2 Age (min) 0 0 Hardware Addr Incomplete 001a. 100-byte ICMP Echos to 192. In this particular design the result of port protection is that R2 and SW2 can communicate. Sending 5.1. SW2 and BB2 can communicate.. Rack1R2#ping 192.1. round-trip min/avg/max = 1/2/8 ms Rack1R2#show arp Protocol Address Internet 192.10. round-trip min/avg/max = 1/1/4 ms Rack1SW2#ping 192.254 Internet 192.10. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).. Sending 5.10.254 Type escape sequence to abort.8 Internet 192.254 Type escape sequence to abort.1.10.1.10. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).a256. Traffic received in a protected port cannot be sent out another protected port.

or broadcast traffic received in a port. bits per second.00% Current ---------0.00% Lower ----------10m bps Current ---------0 bps Lower ----------1. Make sure to use the question mark when implementing this command so that the units entered achieve the desired result.----------Fa0/6 Link Down 10m bps Rack1SW4#show storm-control Interface Filter State Upper --------.com .38 Storm Control • • • Configure SW1 to limit unicast traffic received from R1 to 100 pps.------------. packets per second.INE. or others.00% Copyright © 2008 Internetwork Expert 145 www.0 Bridging & Switching 1.----------Fa0/4 Link Down 1. Rack1SW2#show storm-control Interface Filter State Upper --------.------------. multicast. Configure SW2 to limit broadcast traffic received from R6 to 10Mbps. Configuration SW1: interface FastEthernet0/1 storm-control unicast level pps 100 SW2: interface FastEthernet0/6 storm-control broadcast level 1.00 SW4: interface FastEthernet0/4 storm-control broadcast level bps 10m Verification Note Storm control is used to limit the amount of unicast.CCIE R&S Lab Workbook Volume I Version 5. Depending on the version of IOS the storm-control command may take units in percentage. The most common application of this feature is to prevent broadcast storms. Configure SW4 to limit broadcast traffic received from R4 to 1Mbps using a relative percentage of the interface bandwidth. but it can also be used to police individual ports not to exceed a desired rate.

A simple way to prevent these types of attacks is to statically hard-code which MAC addresses are reachable via which ports. but not R4.e640 vlan 146 interface FastEthernet0/6 SW4: mac-address-table static 000a. by flooding unknown frames everywhere in the VLAN they were received in and by looking at the source MAC address of frames received in its ports. Another static feature of the CAM table is the ability to Null route MAC addresses.com . such as when someone attempts to do a layer 2 MAC address spoofing attack.23f4.CCIE R&S Lab Workbook Volume I Version 5. once complete R1 and R6 should have reachability to each other. or MAC address table.INE. • Configuration SW2: mac-address-table static 000f. Copyright © 2008 Internetwork Expert 146 www.0 Bridging & Switching 1.39 MAC-Address Table Static Entries & Aging • • Ensure reachability on VLAN 146 between R1. if the drop keyword or an unused interface is used in the mac-address-table static command traffic destined to that MAC address will be dropped. Since static entries always override dynamically learned entries. Configure static CAM entry for that MAC address of R6’s connection to VLAN 146 to ensure that this address is not allowed to roam. In certain circumstances this can be undesirable. and R6.cfc2 vlan 146 drop Verification Note Normally switches populate the CAM table.f4b0. Configure a static CAM entry on SW4 so that frames destined to the MAC address of R4’s interface connected to VLAN 146 are dropped. R4.

1.1. 100-byte ICMP Echos to 155. Rack1R1#ping 155. round-trip min/avg/max = 1/2/4 ms Rack1R4#ping 155.f4b0.6. SW4.146.1.0 Bridging & Switching In this particular design R1.INE. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).6. Sending 5.1.146.146.com .cfc2 DYNAMIC Fa0/4 Total Mac Addresses for this criterion: 1 Copyright © 2008 Internetwork Expert 147 www.cfc2 in port Fa0/4. dynamically learns R4’s MAC address 000a.6 Type escape sequence to abort. 100-byte ICMP Echos to 155.1.f4b0.6 Type escape sequence to abort. Sending 5.1. Sending 5. round-trip min/avg/max = 1/3/4 ms Rack1R4# Rack1SW4#show mac-address-table dynamic interface fa0/4 Mac Address Table ------------------------------------------Vlan Mac Address Type Ports ------------------------146 000a.146. and R6 exchange traffic on VLAN 146. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). round-trip min/avg/max = 1/3/4 ms Rack1R1#ping 155. who is connected to R4’s port Fa0/1.146. R4.4.146. 100-byte ICMP Echos to 155.CCIE R&S Lab Workbook Volume I Version 5.4 Type escape sequence to abort.

Sending 5.1.4 Type escape sequence to abort.0 Bridging & Switching When SW4 is configured with a static entry that matches this address with the keyword drop at the end. is dropped in the layer 2 transit path. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5)..6.e640 Mac Address Table ------------------------------------------Vlan ---1 146 Mac Address ----------000f..146.1. End with CNTL/Z. The result is that any traffic going to R4.. timeout is 2 seconds: .com . Sending 5.cfc2 vlan 146 drop Rack1SW4(config)# Rack1R1#ping 155.23f4.e640 Type -------DYNAMIC STATIC Ports ----Fa0/6 Fa0/6 Copyright © 2008 Internetwork Expert 148 www. Rack1SW4#conf t Enter configuration commands. 100-byte ICMP Echos to 155.1.6 Type escape sequence to abort.CCIE R&S Lab Workbook Volume I Version 5.e640 000f.4.. such as the ICMP PING from R1. Rack1SW4(config)#mac-address-table static 000a.23f4.23f4. one per line.1. 100-byte ICMP Echos to 155. the dynamically learned entry is overridden. Success rate is 0 percent (0/5) Likewise traffic going to R6 uses the static entry as opposed to the dynamically learned entry.146.146.146.INE. round-trip min/avg/max = 1/3/4 ms Rack1SW2#show mac-address-table address 000f.f4b0. Rack1R1#ping 155.

Inbound traffic from the Linux host should be placed into VLAN 146. Configure SW4 so that all traffic coming from and going to R4’s connection to VLAN 146 is redirected to a host located on port Fa0/24.40 SPAN • • Configure SW1 so that all traffic transiting VLAN 146 is redirected to a host located on port Fa0/24.INE.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching 1.com . Configuration SW1: monitor session 1 source vlan 146 monitor session 1 destination interface Fa0/24 SW4: monitor session 1 source interface Fa0/4 monitor session 1 destination interface Fa0/24 ingress vlan 146 Copyright © 2008 Internetwork Expert 149 www.

Local SPAN. There are two variations of SPAN.Normally when the SPAN feature is configured the switch drops all traffic coming back in the destination port. traffic coming from or going to a particular port is redirect to another local port. or RSPAN. as seen in this design SW4. With Local SPAN. The ingress keyword tells the switch which access VLAN inbound traffic on the destination port should belong to. as seen on SW1.com . and Remote SPAN. The source of traffic can also be a VLAN.0 Verification Bridging & Switching Note The Switchport Analyzer (SPAN) feature is used to redirect traffic from a port or VLAN onto another port for analysis by devices such as a packet sniffer or Intrusion Prevention Sensor (IPS). default VLAN = 146 Copyright © 2008 Internetwork Expert 150 www. or just SPAN. Rack1SW1#show monitor session 1 Session 1 --------Type : Local Session Source VLANs : Both : 146 Destination Ports : Fa0/24 Encapsulation : Native Ingress : Disabled Rack1SW4#show monitor session 1 Session 1 --------Type : Local Session Source Ports : Both : Fa0/4 Destination Ports : Fa0/24 Encapsulation : Native Ingress : Enabled.CCIE R&S Lab Workbook Volume I Version 5.INE.

CCIE R&S Lab Workbook Volume I Version 5. Configuration SW1: interface FastEthernet0/13 shutdown ! interface FastEthernet0/14 shutdown ! interface FastEthernet0/15 shutdown ! monitor session 2 destination interface Fa0/24 ingress vlan 146 monitor session 2 source remote vlan 500 SW2: monitor session 2 source interface Fa0/4 monitor session 2 destination remote vlan 500 SW4: vlan 500 remote-span Copyright © 2008 Internetwork Expert 151 www. Inbound traffic on the link connected to this host should be placed in VLAN 146.41 RSPAN • • • • • Disable the trunk links between SW1 and SW2. Configure SW2 so that traffic received from and sent to R4’s connection to VLAN 43 is redirected to the RSPAN VLAN. Create VLAN 500 as an RSPAN VLAN on all switches in the topology. Configure SW1 to receive traffic from the RSPAN VLAN and redirect it to a host connected to port Fa0/24.com .0 Bridging & Switching 1.INE.

INE. In this case VTP is used. is all traffic coming in port Fa0/4. Rack1SW1#show monitor session 2 Session 2 --------Type : Remote Destination Session Source RSPAN VLAN : 500 Destination Ports : Fa0/24 Encapsulation : Native Ingress : Enabled. and know about the RSPAN VLAN that is used to encapsulate and transport the monitored traffic.0 Verification Bridging & Switching Note The Remote SPAN. Next the switch attached to the source port or VLAN creates a SPAN session. The destination of the session is the RSPAN VLAN 500 itself. This means that the switch wants to listen for all traffic received in the RSPAN VLAN. default VLAN = 146 Ingress encap : Untagged Copyright © 2008 Internetwork Expert 152 www. Note the remote-span keyword under the VLAN. In this case SW1 says that the source of the session is the remote vlan 500. The first step in configuring RSPAN is to ensure that the switches in the layer 2 transit path from the source port/VLAN to the destination port are trunking at layer 2. so only the VTP server SW4 needs to create the VLAN. The source of this span session. On SW1 therefore all traffic coming in a trunk link with a tag of 500 will be redirected out port Fa0/24. and redirect it out a local port. This means that all traffic that comes in port Fa0/4 will receive a new trunking header with a VLAN 500 tag and be sent out the trunk network. any traffic that SW1 receives in port Fa0/24 will be treated as if it belongs to VLAN 146. Lastly the switch attached to the sniffer/sensor creates a SPAN session with the source as the RSPAN VLAN. and the destination as the local port. or RSPAN.com . in the case of SW2. as this is a special attribute that affects how traffic is processed when it is received in this VLAN. Since the ingress keyword is also used.CCIE R&S Lab Workbook Volume I Version 5. feature is used when the source port or VLAN that is being monitored is on a different physical switch than the destination sniffer or sensor.

INE. Fa0/3. Gi0/1. Fa0/7 Fa0/8. Fa0/17.com .------------------------------1 default active Fa0/1. Gi0/2 5 VLAN0005 active 7 VLAN0007 active 8 VLAN0008 active 9 VLAN0009 active 10 VLAN0010 active 22 VLAN0022 active Fa0/2. Fa0/18. Fa0/15 Fa0/16. Fa0/14.--------. Fa0/9. Fa0/24 43 VLAN0043 active Fa0/4 58 VLAN0058 active 67 VLAN0067 active 79 VLAN0079 active 146 VLAN0146 active 500 VLAN0500 active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup VLAN ---1 5 7 8 9 10 22 43 58 67 79 146 500 1002 1003 1004 1005 Type ----enet enet enet enet enet enet enet enet enet enet enet enet enet fddi tr fdnet trnet SAID ---------100001 100005 100007 100008 100009 100010 100022 100043 100058 100067 100079 100146 100500 101002 101003 101004 101005 MTU ----1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 1500 Parent -----RingNo -----BridgeNo -------Stp ---ieee ibm BrdgMode -------srb Trans1 -----0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Trans2 -----0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Remote SPAN VLANs -----------------------------------------------------------------------------500 Primary Secondary Type Ports ------.0 Rack1SW2#show monitor session 2 Session 2 --------Type : Remote Source Session Source Ports : Both : Fa0/4 Dest RSPAN VLAN : 500 Bridging & Switching Rack1SW2#show vlan VLAN Name Status Ports ---.--------. Fa0/13.----------------. Fa0/22 Fa0/23. Fa0/5.-------------------------------. Fa0/10.CCIE R&S Lab Workbook Volume I Version 5. Fa0/11 Fa0/12.------------------------------------------ Copyright © 2008 Internetwork Expert 153 www.

CCIE R&S Lab Workbook Volume I Version 5. Configure port Fa0/2 with an access VLAN assignment of 146 and a voice VLAN assignment of 600. and Fa0/6 on SW1 will be connected to Cisco IP phones in the near future. and so that the interface runs in STP portfast mode.0 Bridging & Switching 1. Configure port Fa0/4 as an 802.1q trunk link. Enable Spanning-Tree portfast on this link and ensure that CDP is enabled.com . • • Configuration SW1: interface FastEthernet0/2 switchport access vlan 146 switchport voice vlan 600 spanning-tree portfast ! interface FastEthernet0/4 switchport trunk encapsulation dot1q switchport trunk native vlan 146 switchport trunk allowed vlan 146. so that STP BPDUs received on the port are filtered out. Fa0/4.INE. Configure VLAN 146 as the native VLAN for this port and so that VLAN 600 is advertised as the voice VLAN via CDP. Configure port Fa0/6 with an access VLAN assignment of 146.600 switchport mode trunk switchport voice vlan 600 spanning-tree portfast trunk spanning-tree bpdufilter enable ! interface FastEthernet0/6 switchport access vlan 146 switchport voice vlan dot1p SW4: vlan 600 Copyright © 2008 Internetwork Expert 154 www. Configure SW1 so that only VLANs 146 and 600 are permitted on this switchport. and for voice VLAN frames to use dot1p tagging.42 Voice VLAN • • • • • Ports Fa0/2.

Option 3 is to use a single VLAN for Data and Voice. The connection between the IP Phone and the upstream switch is an access port. Based on this there are three different options for connecting the IP Phone and the desktop PC to the Catalyst switches.1q trunk with the native VLAN equal to the Data VLAN. Option 2 is to use a single VLAN for Data and Voice. Additionally the internal switch can also use different 802. The Catalyst switch accepts the frames with VLAN zero as if they are in the access VLAN.1q header that carries a VLAN ID equal to zero and has the CoS field set to 5 for VoIP and the value instructed from the switch for data frames. The internal IP Phone switch will tag VoIP traffic with the respective VLAN number and apply a CoS value of 5. Option 1 is to separate the Data VLAN for the PC and the Voice VLAN for the IP Phone. Copyright © 2008 Internetwork Expert 155 www. The IP Phone’s internal switch does not tag the frames and acts as a simple bridge. but also honors the CoS bits to calculate the switch’s internal QoS tag. The data frames are sent untagged and received by the upstream switch on the configured access VLAN. one port to connect to the upstream switch. The built-in switch is capable of separating the IP Phone and the desktop PC traffic using different VLANs. along with VoIP frames sent from the phone get a special 802.1p markings in the Class of Service (CoS) field to distinguish the IP Phone and the desktop PC frames.com . The connection between the IP Phone and the upstream switch is an 802.INE.CCIE R&S Lab Workbook Volume I Version 5.0 Verification Bridging & Switching Note Many models of Cisco IP Phones have a built-in three-port switch. and the last port to connect to a desktop PC. Data frames received from the PC on the phone. but to add an 802.1p CoS tag. one port for the IP Phone itself.

Copyright © 2008 Internetwork Expert 156 www. Note that as soon as the switchport voice vlan command is applied to the port. Both voice and data frames will share the same VLAN configured on the access port. If the command switchport voice vlan dot1p is configure on a switchport then the connected IP Phone’s switch is instructed to apply VLAN 0 to voice traffic along with the corresponding CoS bits. the spanning-tree portfast feature is automatically enabled.1q trunk via the switchport mode trunk command. Note that there is no need to configure the port as an 802.INE. The command switchport voice vlan configured on an access port will communicate with the IP Phone via CDP and tell its internal switch which VLAN should be used for voice traffic. Both voice and data packets are received on the same VLAN (the access VLAN).0 Bridging & Switching For all three options the IP Phone’s built-in switch should be instructed which mode to use. The IP Phone’s internal switch will then apply the instructed VLAN tag to the voice traffic and will send the PC’s data untagged.com .CCIE R&S Lab Workbook Volume I Version 5. If no switchport voice vlan command is configured. then Option 2 applies automatically. The switchport ASIC will automatically convert the port into a rudimentary trunk.

0 Bridging & Switching 1.43 IP Phone Trust and CoS Extend • • • • Enable MLS QoS globally on SW1.CCIE R&S Lab Workbook Volume I Version 5.INE. SW1 should enforce a CoS value of 1 to any appliance connected to the second port of the IP phone. This trust should only occur if the Cisco IP phone is present and advertises itself via CDP. Configuration SW1: mls qos ! interface FastEthernet0/2 mls qos trust cos mls qos trust device cisco-phone switchport priority extend cos 1 ! interface FastEthernet0/4 mls qos trust cos mls qos trust device cisco-phone switchport priority extend cos 1 ! interface FastEthernet0/6 mls qos trust cos mls qos trust device cisco-phone switchport priority extend cos 1 Copyright © 2008 Internetwork Expert 157 www.com . Configure SW1 to trust the CoS of frames received on the ports connected to the IP phones.

The switch may either accept (trust) 802. This feature particularly makes sense to be used with the dot1p Voice VLAN option.INE. Rack1SW1#show mls qos interface fa0/2 FastEthernet0/2 trust state: not trusted trust mode: trust cos trust enabled flag: dis COS override: dis default COS: 0 DSCP Mutation Map: Default DSCP Mutation Map Trust device: cisco-phone qos mode: port-based Copyright © 2008 Internetwork Expert 158 www. In addition to enforcing markings at the switchport boundary.com . If no Cisco device is detected on the port then the QoS markings are not trusted.1p bits received from the attached PC or enforce the instructed value. even if the port is configured for trust.0 Verification Bridging & Switching Note The QoS trust state of the port determines if frames with a CoS value are maintained or remarked as they are received.CCIE R&S Lab Workbook Volume I Version 5. In this case these ports are configured to trust the QoS marking only if the presence of a Cisco IP Phone is sensed via CDP messages. This option is enabled with the command mls qos trust device cisco-phone. the switch may also instruct the IP Phone’s switch to apply specific CoS markings for frames received from the connected PC.

such as access. the access VLAN.INE. Rack1SW1#config t Rack1SW1(config)#interface range fa0/7-8 Rack1SW1(config-if-range)#macro apply VLAN_146 Rack1SW1(config-if-range)#end 02:11:37: %SYS-5-CONFIG_I: Configured from console by console Rack1SW1#show run interface fa0/7 Building configuration.. The result seen from the show run output is identical to that which would be achieved by manually entering these commands on both interfaces. In this particular design the macro is used to apply three attributes to the interface. and the BPDU Filter feature. • Configuration SW1: macro name VLAN_146 switchport mode access switchport access vlan 146 spanning-tree bpdufilter enable @ Verification Note Smartport Macros are used to define a well known template of configuration to apply onto multiple interfaces.com . This feature is useful in large switching environments where general categories of ports can be defined. Current configuration : 146 bytes ! interface FastEthernet0/7 switchport access vlan 146 switchport mode access macro description VLAN_146 spanning-tree bpdufilter enable end Copyright © 2008 Internetwork Expert 159 www.44 Smartport Macros • Configure a macro on SW1 named VLAN_146 that when applied to an interface will set it to be an access switchport. uplink. Apply this macro to ports Fa0/7 and Fa0/8 on the switch. the switchport mode. and filter Spanning-Tree BPDUs.. and have them share common configuration templates.0 Bridging & Switching 1.CCIE R&S Lab Workbook Volume I Version 5. with the addition of the macro description telling us which macro was applied. server. apply VLAN 146 as the access vlan.

0 Rack1SW1#show run interface fa0/8 Building configuration. and can be seen by issuing the show parser macro command.Enable data VLAN only # Recommended value for access vlan should not be 1 switchport access vlan $access_vlan switchport mode access # Enable port security limiting port to a single # MAC address -.com . Current configuration : 146 bytes ! interface FastEthernet0/8 switchport access vlan 146 switchport mode access macro description VLAN_146 spanning-tree bpdufilter enable end Bridging & Switching A number of default Smartport Macros exist in the switch..CCIE R&S Lab Workbook Volume I Version 5. errdisable recovery cause link-flap errdisable recovery interval 60 # Config Cos to DSCP mappings mls qos map cos-dscp 0 8 16 26 32 46 46 56 # Enable aggressive mode UDLD on all fiber uplinks udld aggressive # Enable Rapid PVST+ and Loopguard spanning-tree mode rapid-pvst spanning-tree loopguard default spanning-tree extend system-id -------------------------------------------------------------Macro name : cisco-desktop Macro type : default interface # macro keywords $access_vlan # Basic interface .that of desktop switchport port-security switchport port-security maximum 1 # Ensure port-security age is greater than one minute # and use inactivity timer switchport port-security violation restrict switchport port-security aging time 2 switchport port-security aging type inactivity # Configure port as an edge network port Copyright © 2008 Internetwork Expert 160 www.INE.. Rack1SW1#show parser macro Total number of macros = 6 -------------------------------------------------------------Macro name : cisco-global Macro type : default global # Enable dynamic port error recovery for link state failures.

to this interface when portfast is enabled. End with CNTL/Z. one per line.. concentrators. Connecting hubs. Current configuration : 332 bytes ! interface FastEthernet0/10 switchport access vlan 10 switchport mode access switchport port-security switchport port-security aging time 2 switchport port-security violation restrict switchport port-security aging type inactivity macro description cisco-desktop spanning-tree portfast spanning-tree bpduguard enable end Copyright © 2008 Internetwork Expert 161 www. Rack1SW1(config-if)#end Rack1SW1#show run interface fa0/10 Building configuration.com . bridges.CCIE R&S Lab Workbook Volume I Version 5.... switches. Current configuration : 34 bytes ! interface FastEthernet0/10 end Rack1SW1#config t Enter configuration commands.. Rack1SW1(config)#interface fa0/10 Rack1SW1(config-if)#macro apply cisco-desktop $access_vlan 10 %Warning: portfast should only be enabled on ports connected to a single host.INE.0 Bridging & Switching spanning-tree portfast spanning-tree bpduguard enable -------------------------------------------------------------<output omitted> A default macro can be applied as follows.. can cause temporary bridging loops. etc. Use with CAUTION %Portfast has been configured on FastEthernet0/10 but will only have effect when the interface is in a non-trunking mode. Rack1SW1#show run interface fa0/10 Building configuration.

1q trunked EtherChannel.0 SW1: interface Port-channel1 switchport trunk encapsulation dot1q switchport mode trunk switchport backup interface Fa0/16 switchport backup interface Fa0/16 preemption mode forced switchport backup interface Fa0/16 preemption delay 20 ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk channel-group 1 mode on ! interface FastEthernet0/14 switchport trunk encapsulation dot1q switchport mode trunk channel-group 1 mode on ! Copyright © 2008 Internetwork Expert 162 www.0 R3: interface FastEthernet0/1 ip address 10.0. R2’s Ethernet interface with the IP address 10.45 Flex Links • • • • • Configure links Fa0/16 between SW2 and SW3 as an 802. Configure links Fa0/13 & Fa0/14 between SW1 and SW2 as an 802.0.1q trunk. and R3’s second Ethernet interface with the IP address 10.0.1/24.0 R2: interface FastEthernet0/0 ip address 10.0.1 255. Configure link Fa0/16 on SW1 and Fa0/13 on SW3 as an 802.com . Configure flex links on SW1 so that traffic from R1 to R3 uses the EtherChannel to SW2.3 255.255.0 Bridging & Switching 1.3/24.0.0. Disable all other inter-switch links.INE.0. • • • Configuration R1: interface FastEthernet0/0 ip address 10.0.2/24.1q trunk.CCIE R&S Lab Workbook Volume I Version 5. If the EtherChannel and all its members comes back up traffic should forward back over this link after 20 seconds.2 255. Configure R1’s Ethernet interface with the IP address 10.0.255.0. If the EtherChannel goes down traffic should immediately switch over to use the link between SW1 and SW3.255.255.0.255.255.0.

0 interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk SW2: interface Port-channel1 switchport trunk encapsulation switchport mode trunk ! interface FastEthernet0/13 switchport trunk encapsulation switchport mode trunk channel-group 1 mode on ! interface FastEthernet0/14 switchport trunk encapsulation switchport mode trunk channel-group 1 mode on ! interface FastEthernet0/16 switchport trunk encapsulation switchport mode trunk Bridging & Switching dot1q dot1q dot1q dot1q SW3: interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/16 switchport trunk encapsulation dot1q switchport mode trunk Copyright © 2008 Internetwork Expert 163 www.INE.CCIE R&S Lab Workbook Volume I Version 5.com .

Sending 5000. one per line. and waits for the line protocol of the active link to go down.0 Verification Bridging & Switching Note The Flex Links feature is used as an alternative to Spanning-Tree Protocol in environments where physical loops occur in the layer 2 network. Rack1SW2(config)#interface po1 Rack1SW2(config-if)#shut Rack1SW2(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1. Flex Links work like the backup interface feature on the routers.0.0. Rack1SW2#conf t Enter configuration commands.0. In this particular design SW1 has Port-Channel1 configured as the active link and FastEthernet0/16 configured as the backup. End with CNTL/Z. in which a layer 2 physical interface or Port-Channel is configured as the “active” link. When the active link’s line protocol status comes back up.CCIE R&S Lab Workbook Volume I Version 5.0. and another layer 2 link is configured as the “backup”. 100-byte ICMP Echos to 10. If the line protocol of the active link is down. timeout is 2 seconds: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! <output omitted> SW2’s Port-Channel1 interface is shutdown. Rack1SW1#show interfaces po1 switchport backup Switch Backup Interface Pairs: Active Interface Backup Interface State -----------------------------------------------------------------------Port-channel1 FastEthernet0/16 Active Up/Backup Standby Rack1R1#ping 10. changed state to administratively down Copyright © 2008 Internetwork Expert 164 www. STP is automatically disabled on both links when Flex Links are enabled.com . changed state to administratively down %LINK-5-CHANGED: Interface FastEthernet0/14. The backup link operates in standby mode.3.3 repeat 5000 Type escape sequence to abort. the backup link becomes active and immediately starts forwarding. the backup link goes back into standby state and stops forwarding traffic.INE. causing SW1’s link to go down. changed state to down %LINK-5-CHANGED: Interface FastEthernet0/13.

updating vtp pruning join bits BACKUP_INT: intf Fa0/16.0 Bridging & Switching SW1 detects this and immediately activates port Fa0/16. bandwidth 100000 Kbps BACKUP_INT: setting WB BACKUP_INT: clearing WB BACKUP_INT: Pair Po1 Fa0/16 mode bandwidth. changed state to down BACKUP_INT: intf Po1. Unscheduled Rack1SW1# %LINK-3-UPDOWN: Interface FastEthernet0/13. This implies that the network converged in less than four seconds. state 2. delay 20 seconds. peer Fa0/16. transition for event 1 sw_backup_int: Fa0/16 is now Up BACKUP_INT: intf Po1..CCIE R&S Lab Workbook Volume I Version 5.. state up. as the default timeout for a ping is two seconds. changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/14. round-trip min/avg/max = 1/2/48 ms Rack1R1# Copyright © 2008 Internetwork Expert 165 www. updating vtp pruning join bits BACKUP_INT: intf Po1. changed state to down Rack1SW1#show interfaces po1 switchport backup Switch Backup Interface Pairs: Active Interface Backup Interface State -----------------------------------------------------------------------Port-channel1 FastEthernet0/16 Active Down/Backup Up R1. changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1. ] <output omitted> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Success rate is 99 percent (4999/5000). changed state to down %LINK-3-UPDOWN: Interface Port-channel1. Unscheduled %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13.INE. bandwidth 100000 Kbps BACKUP_INT: setting WB BACKUP_INT: clearing WB BACKUP_INT: Pair Po1 Fa0/16 mode bandwidth. dropped one packet out of 5000. Rack1SW1#debug backup all Switch Backup Interface all debugging is on sw_backup_int: intf Po1. state Down sw_backup_int: intf Fa0/16. transition for event 0 sw_backup_int: Po1 is now Down BACKUP_INT: idb Po1.com . state 1. delay 20 seconds. state down. [Resuming connection 1 to r1 . changed state to down %LINK-3-UPDOWN: Interface FastEthernet0/14. who was sending traffic to R3 while the failure occurred.

Scheduled %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13. BI Fa0/16 bi_state 1 bi_bw 100000 BACKUP_INT: Pair Po1 Fa0/16 mode bandwidth. peer Po1. BI Fa0/16 bi_state 1 bi_bw 100000 BACKUP_INT: Pair Po1 Fa0/16 mode bandwidth. After the 20 second delay expires. transition for event 5 BACKUP_INT: idb Fa0/16. BI Fa0/16 bi_state 1 bi_bw 100000 %BACKUP_INTERFACE-5-PREEMPT: Preempting interface Fa0/16 in backup pair (Po1. state Waiting for peer state sw_backup_int: intf Fa0/16. a preemption delay counter starts. state up. peer Fa0/16. preemption mode is bandwidth <output omitted> Rack1SW1#show interfaces po1 switchport backup Switch Backup Interface Pairs: Active Interface Backup Interface State -----------------------------------------------------------------------Port-channel1 FastEthernet0/16 Active Up/Backup Standby Copyright © 2008 Internetwork Expert 166 www. the bandwidth of the Fa0/16 interface is compared with Po1 due to the preemption mode bandwidth command. state Waiting to sync sw_backup_int: intf Po1. changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1. and Fa0/16 goes into the standby state. as configured with the preemption delay 20 command. bandwidth 200000 Kbps BACKUP_INT: setting WB BACKUP_INT: clearing WB BACKUP_INT: AI Po1 ai_state 2 ai_bw 200000. transition for event 2 sw_backup_int: Po1 is now Waiting to sync BACKUP_INT: idb Po1. state up. transition for event 3 sw_backup_int: Po1 is now Standby BACKUP_INT: intf Po1. Rack1SW2(config)#int po1 Rack1SW2(config-if)#no shut Rack1SW1# %LINK-3-UPDOWN: Interface FastEthernet0/13.INE. state Up sw_backup_int: intf Po1. delay 20 seconds. Since Po1 has a higher bandwidth value it preempts Fa0/16.CCIE R&S Lab Workbook Volume I Version 5. changed state to up %LINK-3-UPDOWN: Interface FastEthernet0/14. bandwidth 200000 Kbps BACKUP_INT: setting WB BACKUP_INT: clearing WB BACKUP_INT: AI Po1 ai_state 2 ai_bw 200000. state 3. peer Fa0/16. state 4. state 0. changed state to up %LINK-3-UPDOWN: Interface Port-channel1.com . changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/14. changed state to up BACKUP_INT: intf Po1.0 Bridging & Switching When the Po1 interface of SW1 comes back up. Fa0/16). Scheduled Rack1SW1# BACKUP_INT: AI Po1 ai_state 2 ai_bw 200000. state 1. changed state to up sw_backup_int: intf Po1. transition for event 6 sw_backup_int: Po1 is now Waiting for peer state BACKUP_INT: idb Po1. delay 20 seconds.

255.0.4 255.255.INE. Configure R6’s second Ethernet interface with the IP address 106.255.0.0.10 255. and with the IPv6 address 2001::6/24. Enable RIPv2 on all of these links.255.0. Configure interface VLAN104 on SW4 with the IP address 104.10/24.255.0 ipv6 address 2001::4/64 ! router rip version 2 no auto-summary network 104.0 R6: interface FastEthernet0/1 ip address 106.255.10 255.0.255.0. and configure interface Fa0/4 in VLAN 104.0 bridge-group 1 ! interface Vlan104 ip address 104. Configuration R4: interface FastEthernet0/1 ip address 104. and with the IPv6 address 2001::4/24.10/24.46 Fallback Bridging • • • • • • Configure R4’s second Ethernet interface with the IP address 104.0.CCIE R&S Lab Workbook Volume I Version 5.0.0.0 ipv6 address 2001::6/64 ! router rip version 2 no auto-summary network 106.0.6 255.0.0. Configure fallback bridging on SW4 to bridge the IPv6 subnet of R4 and R6 together.0.6/24.0.0 Bridging & Switching 1.0 bridge-group 1 ! Copyright © 2008 Internetwork Expert 167 www.0.com .0.0 SW4: vlan 104 ! bridge 1 protocol vlan-bridge ! interface FastEthernet0/4 switchport access vlan 104 ! interface FastEthernet0/6 no switchport ip address 106.0.0.0. Configure interface Fa0/6 on SW4 with the IP address 106.0.255.4/24.

0 Bridging & Switching Verification Note The Fallback Bridging feature is used to bridge non-routed protocols between SVIs or native layer 3 routed interfaces.0. traffic from host 10.1 is routed at layer 3. This is done by configuring fallback bridging on SW4’s SVI interface VLAN104 connecting to R4 and the native layer 3 routed interface FastEthernet0/6 connecting to R6.0.0.0. and VLAN 20 with the IP subnet 20.0. If fallback bridging is configured on the SVI interfaces of VLAN 10 and VLAN 20. For example if a Catalyst switch has two layer 3 interfaces configured. but can be in the same IPX network and have their IPX traffic bridged together.com . where one protocol stack is routed on an interface while another protocol stack is bridged.0 ip routing ! router rip version 2 no auto-summary network 104. VLAN 10 with the IP subnet 10.2(25).0.0/8.0.INE.0/8.0. Copyright © 2008 Internetwork Expert 168 www. 10. which does not support IPv6 routing.1 are in different IPv4 subnets. There are only two steps to implement this feature.0.0 network 106.1 and 20. In this design the feature is tested by bridging IPv6 traffic between R4 and R6. create the fallback bridge group with the bridge [num] protocol vlan-bridge command.0.0.0.1 and 20.0. In this topology SW4 is a 3550 running IOS 12. but IPv6 can be bridged through fallback bridging. This feature is similar in theory to the Concurrent Routing and Bridging (CRB) and Integrated Routing and Bridging (IRB) features on the routers. This means that IPv4 will be routed.0.CCIE R&S Lab Workbook Volume I Version 5. and apply it to the layer 3 interfaces with the bridge-group [num] command.0.0.

0.0.6 0 msec * 0 msec Rack1R4#traceroute 2001::6 Type escape sequence to abort.0.0 Bridging & Switching We can see the result of this design is that when R4 does a traceroute to R6 via IPv4.0.10 4 msec 0 msec 4 msec 2 106. However when IPv6 traceroute is done between R4 and R6 they appear to be directly connected. and then sent to R6.0. the traffic is routed to SW4.0. Tracing the route to 2001::6 1 2001::6 4 msec 0 msec 0 msec Copyright © 2008 Internetwork Expert 169 www. Tracing the route to 106.0.6 Translating "106.CCIE R&S Lab Workbook Volume I Version 5.com .0. Rack1R4#traceroute 106.INE.0.0.6" Type escape sequence to abort.6 1 104.

and VLAN 3000 to R6.0. Configure the primary VLAN 100 to service private VLANs 1000.0.2 255.0.1 255.Y/24. 2000. R5.0.0 R5: interface FastEthernet0/0 ip address 100.0.255. VLAN 2000 to the links connecting to R4 & R5.0 R2: interface FastEthernet0/0 ip address 100.0.INE.255. while VLAN 3000 should be an isolated VLAN. and 3000. Ensure that R1 can reach all devices. and R4 can reach R5.0.CCIE R&S Lab Workbook Volume I Version 5.0.255.0.com .0.255.255.0 R6: interface FastEthernet0/0 ip address 100.6 255. R2. where Y is the device number. R3.0 Copyright © 2008 Internetwork Expert 170 www.255.0.0.47 Private VLANs • • • • • • • • Configure the first Ethernet interfaces of R1.0 R4: interface FastEthernet0/0 ip address 100.4 255.0.5 255.255.255. and R6 with IP addresses 100. Configure the first inter-switch link between SW1 and SW2 as a trunk.255.3 255. No other connectivity should be allowed within this topology. The link connecting to R1 should be a promiscuous port.0 R3: interface FastEthernet0/0 ip address 100. R2 can reach R3. Configuration R1: interface FastEthernet0/0 ip address 100. R4.255.0 Bridging & Switching 1.255. VLANs 1000 and 2000 should be community VLANs.0.255. Assign VLAN 1000 to the links connecting to R2 & R3.

2000.3000 ! vlan 1000 private-vlan community ! vlan 2000 private-vlan community ! vlan 3000 private-vlan isolated ! interface FastEthernet0/1 switchport private-vlan mapping 100 1000.0 SW1: vtp domain PVLANS vtp mode transparent ! vlan 100 private-vlan primary private-vlan association 1000.2000.INE.com .3000 ! vlan 1000 private-vlan community ! vlan 2000 private-vlan community ! vlan 3000 private-vlan isolated ! interface FastEthernet0/2 switchport private-vlan host-association 100 1000 switchport mode private-vlan host ! interface FastEthernet0/4 switchport private-vlan host-association 100 2000 switchport mode private-vlan host Bridging & Switching Copyright © 2008 Internetwork Expert 171 www.CCIE R&S Lab Workbook Volume I Version 5.3000 switchport mode private-vlan promiscuous ! interface FastEthernet0/3 switchport private-vlan host-association 100 1000 switchport mode private-vlan host ! interface FastEthernet0/5 switchport private-vlan host-association 100 2000 switchport mode private-vlan host ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk SW2: vtp domain PVLANS vtp mode transparent ! vlan 100 private-vlan primary private-vlan association 1000.2000.

where two hotel rooms or offices may be in the same subnet and VLAN but should not communicate directly. but should not communicate directly with each other. in which two or more ports can be in the same VLAN but cannot directly communicate at layer 2. Copyright © 2008 Internetwork Expert 172 www.com .CCIE R&S Lab Workbook Volume I Version 5.0 ! interface FastEthernet0/6 switchport private-vlan host-association 100 3000 switchport mode private-vlan host ! interface FastEthernet0/13 switchport trunk encapsulation dot1q switchport mode trunk Bridging & Switching Verification Note The Private VLAN (PVLANs) feature is similar in theory to the Protected Ports feature. that is normally defined by a single VLAN. or in Multiple Dwelling Units (MDUs) such as hotels or office buildings. and allow very complex security policies that can span between multiple physical switches. Pitfall The Private VLAN feature requires VTP to run in transparent mode. that are defined by primary VLAN and its secondary VLANs. Private VLANs split a single broadcast domain. in which customers are on the same VLAN and same IP subnet. Design-wise this feature is commonly used in environments like shared ISP colocation. Private VLANs expand this concept much further however. In essence the feature allows us to configure VLANs inside a VLAN.INE. into multiple isolated broadcast subdomains.

Next the command switchport mode private-vlan promiscuous or switchport mode private-vlan host is configured at the interface level. As you might guess the promiscuous option defines that the port role is promiscuous. Promiscuous ports are allowed to talk to all other ports within the VLAN.3000 configured. These are promiscuous ports. 2000. Since VLAN 1000 was defined as a community VLAN. which defines what other ports it can talk to. and 3000. and defined as either community or isolated. The link to R3 has the command switchport private-vlan hostassociation 100 1000 configured. and the secondary VLANs are associated with the primary VLAN. Community ports are allowed to talk to other ports in their own community. and isolated ports. and can talk to any promiscuous ports.2000. Copyright © 2008 Internetwork Expert 173 www. but not ports in different communities. which means that is it a member of the primary VLAN 100 and the secondary VLAN 1000.CCIE R&S Lab Workbook Volume I Version 5. Isolated ports are only allowed to talk to promiscuous ports. and one or more secondary VLANs. First we must define the different port roles used in PVLANs.com .0 Bridging & Switching Note While the theory of PVLANs is relatively straight forward. this implies that R3 can talk to all other ports in VLAN 1000 and any promiscuous ports belonging to VLAN 100. First the secondary VLANs are created. the implementation can be confusing due to the different terms that Cisco uses to describe VLANs and ports. which means that it is a promiscuous port in the primary VLAN 100 and can talk to all ports in the secondary VLANs 1000. In this case the link to R1 has the command switchport private-vlan mapping 100 1000. Next the primary VLAN is defined.INE. while the host option defines that the port role is either community or isolated. Lastly the port is assigned to both the primary and secondary VLANs. and the syntax in which they are bound together. community ports. Configuration-wise the port roles are defined by the interface’s association to a primary VLAN.

3.255.0.5.0 Rack1SW1#show vlan private-vlan Primary ------100 100 100 Secondary --------1000 2000 3000 Type ----------------community community isolated Bridging & Switching Ports ----------------------------------Fa0/1. As defined in the requirements R1 can talk to all routers.0.255. 4 ms Reply to request 0 from 100. timeout is 2 seconds: Reply to request 0 from 100. 100.INE. Rack1R2#ping 255. Sending 1.255.255.255.255.0.255. 100-byte ICMP Echos to 255.0. 4 4 4 4 4 ms ms ms ms ms R2 can talk to R3.CCIE R&S Lab Workbook Volume I Version 5.255 repeat 1 Type escape sequence to abort.3.6.0.255. Fa0/5 Fa0/1 Rack1SW2#show vlan private-vlan Primary ------100 100 100 Secondary --------1000 2000 3000 Type ----------------community community isolated Ports ----------------------------------Fa0/2 Fa0/4 Fa0/6 Final verification for this configuration can be obtained by sending traffic to the broadcast address of 255.com .255 from all devices.0. Fa0/3 Fa0/1.0.0. 4 ms Copyright © 2008 Internetwork Expert 174 www. 100. and R1 who is a promiscuous port.0.1. Sending 1.255. 100.0. Rack1R1#ping 255.0.0.255.255 repeat 1 Type escape sequence to abort. timeout is 2 seconds: Reply Reply Reply Reply Reply to to to to to request request request request request 0 0 0 0 0 from from from from from 100. 100-byte ICMP Echos to 255.0. 100. who is in the same community. since it is a promiscuous port.255.2.255.0.4.

0.1. timeout is 2 seconds: Reply to request 0 from 100.INE.255. 4 ms R5 can talk to R4.255. and R1 who is a promiscuous port. 100-byte ICMP Echos to 255.0. 4 ms R4 can talk to R5. R1. timeout is 2 seconds: Reply to request 0 from 100.0.255 repeat 1 Type escape sequence to abort. and R1 who is a promiscuous port.0. 4 ms Since R6 is an isolated port it can only talk to the promiscuous port.4.1. Rack1R6#ping 255.0.255. 4 ms Reply to request 0 from 100.0.255.255. Sending 1. Rack1R4#ping 255. who is in the same community.255.255.0. Sending 1.255.CCIE R&S Lab Workbook Volume I Version 5. 4 ms Copyright © 2008 Internetwork Expert 175 www. Sending 1.255 repeat 1 Type escape sequence to abort.255.com . Rack1R5#ping 255. Rack1R3#ping 255.255.255.255 repeat 1 Type escape sequence to abort.255. timeout is 2 seconds: Reply to request 0 from 100. who is in the same community.0. who is in the same community.255.0.255 repeat 1 Type escape sequence to abort. 100-byte ICMP Echos to 255.5.1.1. 4 ms Reply to request 0 from 100.255. 100-byte ICMP Echos to 255. 100-byte ICMP Echos to 255.2. Sending 1.255.255.255. 4 ms Reply to request 0 from 100.0. and R1 who is a promiscuous port.0.255.0 Bridging & Switching R3 can talk to R2.0.0.0. timeout is 2 seconds: Reply to request 0 from 100.255.255.

Within the scope of CCIE R&S lab you may have to deal with PPP being run on top of dedicated Serial links. as it could be tunneled over any other L2 or L3 protocol (e. the authenticator simply waits for the remote node to send a username and password pair in cleartext. point to point) links. the routers should agree on the authentication protocol using configuration requests.e. In any case. encryption and so on. R5 should refuse PAP authentication and use CHAP. Use the name R5PPP and the password of CISCO to accomplish this. PPP is also a very widely adopted VPN solution. link compression procedure. PPPoA and L2TPv3 or PPTP even allow for running PPP across an IP cloud) and provide rich auto-configuration services. callback.48 PPP • • • • • Enable PPP encapsulation for the Serial link connecting R4 and R5 and use the IP subnet 155. There are two common methods of authenticating (i.0 Bridging & Switching 1. which is an optional feature that occurs after the link has been established via LCP by no L3 protocols have been negotiated via NCP.X.e. If the pair matches the locally configured credentials. PPPoE. the authenticator prompts the remote node with a “challenge” strings and its own hostname. Make sure R4 uses an alternate CHAP hostname R4CHAP. we’ll discuss one important aspect of LCP – link authentication. serial and other types of WAN links. The framing format has been derived from simpler HDLC but they main feature of PPP are two protocols LCP (link control protocol) and NCP (network control protocol). Ethernet segments (PPPoE) or other Frame-Relay (PPPoFR). Here is how PAP and CHAP work: 1) Using PAP. verifying the identity) of a remote endpoint – PAP (password authentication protocol) and CHAP (challenge and response protocol). Configuration Note PPP (point-to-point protocol) is the universal layer 2 encapsulation method for Serial (i.CCIE R&S Lab Workbook Volume I Version 5. For example LCP could be used to negotiate an authentication scheme. the authenticator declares the link to be authenticated.0/24 for this link R4 should attempt to authenticate R5 using PAP and than CHAP. NCP allows for running any layer 3 protocol on top of PPP by embedding the protocol’s parameter negotiation into PPP. This allows the remote end to pick up the proper Copyright © 2008 Internetwork Expert 176 www. In this scenario.INE.com . 2) Using CHAP. These two allow for flexible link configuration and protocol extension.45. During the LCP phase. many PPP configuration steps remain the same. R5 should authenticate R4 using PAP only. R4 should use the name R4PPP and the password of CISCO. Those two features made PPP a very popular protocol for dialup.g.

com . For responding to incoming CHAP challenges. Notice the reverse logic – the username database is being inspected for outgoing credentials. If they match. Notice that the authenticating host also includes its own hostname in the response as well so the authenticator may find the right key as well.0 Bridging & Switching authentication key. This allows for secure authentication over unencrypted links. the authenticating end should be configured for PAP or CHAP credentials using either of two methods: 1) Using the global command username <AUTHEN_NAME> password <PASSWORD> which specifies a name/password pair matching the PPP ID of the authenticator router (it’s the hostname). Notice that the above configuration should be performed on the authenticator only. the one that is being offered an authentication method. enable PPP encapsulation on the interface and use the command ppp authentication: R4: interface Serial 0/1/0 encapsulation ppp ppp authentication pap chap The command above means that R4 will offer PAP authentication and if the remote end rejects it will offer CHAP authentication. based on the incoming hostname. not to match the incoming. the remote node is declared to be authenticated. This is the only way to configure multiple CHAP credentials. This command should be configured on the “authenticating” end. You may configure an endpoint to reject a particular authentication method offered using the command ppp {pap|chap} refuse. This is the only way to define outgoing PAP credentials for the local end of the connection. Copyright © 2008 Internetwork Expert 177 www. the authenticator performs the same hash calculation (keyed with the password value) and compares it to the response. e. This method only works for CHAP as it’s the method that is being initiated by the authenticator (see above). Next. The similarly looking command ppp chap hostname <NAME> defines an alternate CHAP hostname to be used in CHAP challenges or responses instead of the regular hostname. you may use the interface-level command ppp chap password <PWD>. matching multiple remote hostnames.INE. To configure the router as a PPP authenticator. 2) Using the interface-level command ppp sent-username <NAME> password <PWD> to send outgoing PAP credentials when PAP is negotiated. and respond to the authenticator using the hash function calculated over the challenge string and the authentication key matching the authenticator. This command defines the default password matching any incoming CHAP challenge or sent when there is no password found in the list of local usernames.CCIE R&S Lab Workbook Volume I Version 5. After that.g.

1.0 Bridging & Switching Here is an example of configuring R5 for outgoing PAP credentials and a name/password pair for CHAP request: R5: username R4PPP password CISCO ! interface Serial 0/1/0 ppp pap sent-username R5PPP password CISCO Keep in mind that a PPP endpoint could be configured as both the authenticator and the authenticating endpoint.com .0 ppp authentication pap chap ppp pap sent-username R4PPP password CISCO ppp chap hostname R4CHAP ! username R5CHAP password CISCO ! R5: default interface Serial 0/1/0 interface Serial 0/1/0 clock rate 128000 encapsulation ppp ip address 155.5 255. In our scenario.45. with R4 using CHAP to authenticate R5 and R5 using PAP to authenticate R4.45.INE.1.0 ppp authentication pap ppp pap refuse ppp chap hostname R5CHAP ! username R4PPP password CISCO username R4CHAP password CISCO Copyright © 2008 Internetwork Expert 178 www.4 255.CCIE R&S Lab Workbook Volume I Version 5. R4: default interface Serial 0/1/0 interface Serial 0/1/0 clock rate 128000 encapsulation ppp ip address 155.255. both R4 and R5 authenticate each other.255.255.255.

Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: Phase is ESTABLISHING. including authentication.0 Bridging & Switching Verification Note Enable PPP debugging and bring the Serial link down then back up.INE. CHAP is suggested instead. Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 LCP: I CONFREQ [REQsent] id 11 len 14 LCP: AuthProto PAP (0x0304C023) LCP: MagicNumber 0x1A9C8EC2 (0x05061A9C8EC2) LCP: O CONFNAK [REQsent] id 11 len 9 LCP: AuthProto CHAP (0x0305C22305) LCP: I CONFACK [REQsent] id 2 len 14 LCP: AuthProto PAP (0x0304C023) LCP: MagicNumber 0x1854B341 (0x05061854B341) LCP: I CONFREQ [ACKrcvd] id 12 len 15 LCP: AuthProto CHAP (0x0305C22305) Copyright © 2008 Internetwork Expert 179 www. negotiating various link options. The remote end then ofers CHAP and the local end agrees. changed state to up Se0/1/0 PPP: Using default call direction Se0/1/0 PPP: Treating connection as a dedicated line Se0/1/0 PPP: Session handle[2B000026] Session id[77] PPP starts LCP trying to establish the link. Active Open PPP: Authorization required LCP: O CONFREQ [Closed] id 2 len 14 LCP: AuthProto PAP (0x0304C023) LCP: MagicNumber 0x1854B341 (0x05061854B341) Incoming request for PAP gets rejected by the local end.CCIE R&S Lab Workbook Volume I Version 5. RSRack1R5#debug ppp negotiation PPP protocol negotiation debugging is on RSRack1R5#debug ppp authentication PPP authentication debugging is on RSRack1R5#debug aaa authentication AAA Authentication debugging is on RSRack1R5#conf t RSRack1R5(config)#interface serial 0/1/0 RSRack1R5(config-if)#no shutdown RSRack1R5(config-if)# Se0/1/0 PPP: Outbound cdp packet dropped RSRack1R5(config-if)# %LINK-3-UPDOWN: Interface Serial0/1/0. You may see a series of CONF REQUESTS and CONF ACK or NACKS flowing down.com .

not the LCP Authentication phase begins.CCIE R&S Lab Workbook Volume I Version 5. The hostname in the response is taken from the interface configuraiton command. Authenticated User Se0/1/0 PPP: Sent LCP AUTHOR Request Se0/1/0 PPP: Sent IPCP AUTHOR Request R5 finds the local key and prepares a CHAP response. This allows R5 to select the local key from the list of the usernames: Se0/1/0 CHAP: I CHALLENGE id 5 len 27 from "R4CHAP" AAA/AUTHEN/PPP (0000004B): Pick method list 'Permanent Local' Se0/1/0 PPP: Received LOGIN Response PASS Se0/1/0 PPP: Phase is FORWARDING. Notice that both ends perform authentication (AUTHENTICATING.INE. Next you may see I AUTH-REQ from R4 which means R4 starts sending its name and password continuously: Se0/1/0 LCP: State is Open Se0/1/0 PPP: Phase is AUTHENTICATING. Unauthenticated User AAA/AUTHEN/PPP (0000004B): Pick method list 'Permanent Local' Se0/1/0 PPP: Sent PAP LOGIN Request At the same time. Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 CHAP: Using hostname from interface CHAP CHAP: Using password from AAA CHAP: O RESPONSE id 5 len 27 from "R5CHAP" LCP: Received AAA AUTHOR Response PASS IPCP: Received AAA AUTHOR Response PASS R5 confirms R4’s PAP credentials and authenticates R4. Attempting Forward Se0/1/0 PPP: Phase is AUTHENTICATING. R4 responds back that teh response to CHAP challenge was correct. Attempting Forward Se0/1/0 PPP: Phase is AUTHENTICATING. At the same time. by both Se0/1/0 PAP: I AUTH-REQ id 1 len 16 from "R4PPP" Se0/1/0 PAP: Authenticating peer R4PPP Se0/1/0 PPP: Phase is FORWARDING.0 Se0/1/0 LCP: Bridging & Switching MagicNumber 0x1A9C8EC2 (0x05061A9C8EC2) Se0/1/0 LCP: O CONFACK [ACKrcvd] id 12 len 15 Se0/1/0 LCP: AuthProto CHAP (0x0305C22305) Se0/1/0 LCP: MagicNumber 0x1A9C8EC2 (0x05061A9C8EC2) Link has been established.com . Se0/1/0 PAP: O AUTH-ACK id 1 len 5 Se0/1/0 CHAP: I SUCCESS id 5 len 4 Copyright © 2008 Internetwork Expert 180 www. R4 attempts to authenticate R5 by sending a CHAP challenge with its alternate hostname. by both).

1.0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: Phase is UP IPCP: O CONFREQ [Closed] id 1 len 10 IPCP: Address 155.4.4.0 IPCP: O CONFACK [REQsent] id 1 len 10 IPCP: Address 155.0 Bridging & Switching At this point the link is authenticated.45.4. and the NCP phase (IPCP) starts.1. Her address 155.0.0.4 CDPCP: I CONFACK [REQsent] id 1 len 4 CDPCP: I CONFREQ [ACKrcvd] id 2 len 4 CDPCP: O CONFACK [ACKrcvd] id 2 len 4 CDPCP: State is Open Copyright © 2008 Internetwork Expert 181 www. Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 0.0. we want 0.INE.4 (0x03069B012D04) IPCP: I CONFACK [ACKsent] id 1 len 10 IPCP: Address 155.45.CCIE R&S Lab Workbook Volume I Version 5.1. Her address 155.1.45.1.4 (0x03069B012D04) AAA/AUTHOR/IPCP: Start.5 (0x03069B012D05) PPP: Sent CDPCP AUTHOR Request PPP: Process pending ncp packets IPCP: I CONFREQ [REQsent] id 1 len 10 IPCP: Address 155. we want PPP: Sent IPCP AUTHOR Request CDPCP: I CONFREQ [Closed] id 1 len 4 AAA/AUTHOR/IPCP: Reject 155. using 0.1.45.0.0.0 AAA/AUTHOR/IPCP: Done.45.com .1.45.45.45.1.0.5 (0x03069B012D05) IPCP: State is Open CDPCP: Received AAA AUTHOR Response PASS CDPCP: O CONFREQ [Closed] id 1 len 4 IPCP: Install route to 155.

0 Bridging & Switching 1. R5. The only significant difference is the fact that there is no real RADIUS or TACACS+ server in the CCIE R&S lab exam. To configure an AAA group use the command aaa group server {radius|tacacs+} <NAME>. as it mentions that the AAA server should not be configured globally. Configure AAA authentication for PPP is no different than configuring any other service authentication or authorization. We are not going to cover AAA framework in depth here. accessible only under the particular group.146. every method you configured for PPP should be configured to fall back to local authentication or any other backup method.49 PPP AAA Authentication • • • • • Reconfigure R4 so that it attempts to authenticate R5 against the RADIUS server at the IP address 155. Do not use global configuration commands to define a RADIUS server in R4.The other router. Therefore. so you have to deal with imaginary situation. Configuration Note Using remote AAA servers for PPP authentication is common in large-scale deployments.CCIE R&S Lab Workbook Volume I Version 5. In case if the remote AAA servers fail both R4 and R5 should use the local user database for authentication.146.INE.100. use the interface-level command ppp authentication {pap|chap} <AAA_GROUP>. Notice that in most situations you may just resort to using the default AAA list for PPP configured using the command aaa authentication ppp default {<SERVER_GROUP> Copyright © 2008 Internetwork Expert 182 www. is configured using the standard global RADIUS server configuration. When populating the group.X.X. Use the password value of CISCO to authenticate with the remote servers. In order to configure a particular Serial interface to use a non-default PPP authentication or authorization group. use the command server to refer a globally configured RADIUS or TACACS+ server or the command server-private to refer to the locally configured server. Reconfigure R5 so that it attempts to authenticate R4 against the TACACS+ server at the IP address 155.200. This particular scenario calls for creating of an AAA group.com . You may then reference the group when creating an AAA list using the command similar to aaa authentication ppp <AAA_GROUP> group <SERVER_GROUP>. as you can read about it referring to the Security section of this workbook.

com . When you specify just the radius or tacacs+ keywords.146. You may want to use name lists when you have to use different AAA servers for multiple interfaces connected to the same router. By default enabling AAA will switch the console authentication mode to local authentication and might lock you out of the router.100 key CISCO ! interface Serial 0/1/0 ppp authentication pap chap PPPAUTH ! line console 0 login authentication CONSOLE R5: aaa new-model aaa authentication login CONSOLE none aaa authentication ppp default group tacacs local ! tacacs-server host 155.1.200 key CISCO ! line console 0 login authentication CONSOLE Copyright © 2008 Internetwork Expert 183 www.146.INE.0 Bridging & Switching |radius|tacacs+}. Pay attention to the special configuration needed to make sure the console line is not authenticated. the globally configured servers will be used in sequence they have been configured.1.CCIE R&S Lab Workbook Volume I Version 5. R4: aaa new-model aaa authentication login CONSOLE none aaa authentication ppp PPPAUTH group MYRADIUS local ! aaa group server radius MYRADIUS server-private 155.

RSRack1R4#debug radius Radius protocol debugging is on Radius protocol brief debugging is off Radius protocol verbose debugging is off Radius packet hex dump debugging is off Radius packet protocol debugging is on Radius elog debugging debugging is off Radius packet retransmission debugging is off Radius server fail-over debugging is off Radius elog debugging debugging is off RSRack1R4#debug ppp negotiation PPP protocol negotiation debugging is on RSRack1R4#debug ppp authentication PPP authentication debugging is on RSRack1R4#debug radius Radius protocol debugging is on Radius protocol brief debugging is off Radius protocol verbose debugging is off Radius packet hex dump debugging is off Radius packet protocol debugging is on Radius elog debugging debugging is off Radius packet retransmission debugging is off Radius server fail-over debugging is off Radius elog debugging debugging is off Bounce R4’s Serial interface and observe the flow of the debugging messages: Se0/1/0 PPP: Sending Acct Event[Down] id[4C] Se0/1/0 CDPCP: State is Closed Se0/1/0 IPCP: State is Closed Se0/1/0 PPP: Phase is TERMINATING Se0/1/0 LCP: State is Closed Se0/1/0 PPP: Phase is DOWN Se0/1/0 IPCP: Remove route to 155. changed state to down RSRack1R4(config-if)#no shutdown RSRack1R4(config-if)# Se0/1/0 PPP: Outbound cdp packet dropped RSRack1R4(config-if)# %LINK-3-UPDOWN: Interface Serial0/1/0.1.INE.5 %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0.com .45. changed state to up Se0/1/0 PPP: Using default call direction Copyright © 2008 Internetwork Expert 184 www.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching Verification Note Enable RADIUS debugging in R4 in addition to the regular PPP debugging commands.

len 90 RADIUS: authenticator F5 24 28 26 F5 46 99 F6 .0. Attempting Forward PPP: Phase is AUTHENTICATING. Next we see RADIUS packets being sent to the server. RADIUS/ENCODE(0000004D):Orig. component type = PPP RADIUS: AAA Unsupported Attr: interface [175] 11 RADIUS: 53 65 72 69 61 6C 30 2F 31 [Serial0/1] RADIUS(0000004D): Config NAS IP: 0.com .1.100:1645 id 1645/1. Active Open Authorization NOT required O CONFREQ [Closed] id 15 len 14 AuthProto PAP (0x0304C023) MagicNumber 0x1AE0862A (0x05061AE0862A) I CONFREQ [REQsent] id 4 len 14 AuthProto PAP (0x0304C023) MagicNumber 0x1898AA5B (0x05061898AA5B) O CONFACK [REQsent] id 4 len 14 AuthProto PAP (0x0304C023) MagicNumber 0x1898AA5B (0x05061898AA5B) I CONFNAK [ACKsent] id 15 len 9 AuthProto CHAP (0x0305C22305) O CONFREQ [ACKsent] id 16 len 15 AuthProto CHAP (0x0305C22305) MagicNumber 0x1AE0862A (0x05061AE0862A) I CONFACK [ACKsent] id 16 len 15 AuthProto CHAP (0x0305C22305) MagicNumber 0x1AE0862A (0x05061AE0862A) State is Open This is where authentication phase starts.0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: PPP: PPP: PPP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: LCP: Bridging & Switching Treating connection as a dedicated line Session handle[B400003C] Session id[78] Phase is ESTABLISHING.CCIE R&S Lab Workbook Volume I Version 5.1.0.45. Unauthenticated User PPP: Sent CHAP LOGIN Request From the above output we can see that R4 sends CHAP challenge and receives CHAP response. by both PAP: Using hostname from interface PAP PAP: Using password from interface PAP PAP: O AUTH-REQ id 3 len 16 from "R4PPP" CHAP: O CHALLENGE id 7 len 27 from "R4CHAP" PAP: I AUTH-ACK id 3 len 5 CHAP: I RESPONSE id 7 len 27 from "R5CHAP" PPP: Phase is FORWARDING.146. Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: Phase is AUTHENTICATING.1.146.100 RADIUS(0000004D): Send Access-Request to 155.INE.2B B5 BD 5A 64 B8 7C F9 RADIUS: Framed-Protocol [7] 6 PPP [1] Copyright © 2008 Internetwork Expert 185 www.4 for Radius-Server 155.0 RADIUS/ENCODE(0000004D): acct_session_id: 74 RADIUS(0000004D): sending RADIUS/ENCODE: Best Local IP-Address 155.

45.1. Attempting Forward PPP: Phase is AUTHENTICATING.100:1645.4 Bridging & Switching [1] [2] The router keeps retransmitting the packets until it declares the server dead and switches back to local authentication.45. FAIL RADIUS/DECODE: Case error(no response/ bad packet/ op decode).1646) for id 1645/1 CHAP: I RESPONSE id 7 len 27 from "R5CHAP" CHAP: Ignoring Additional Response AUTH: Timeout 1 RADIUS: Retransmit to (155.5 (0x03069B012D05) IPCP: O CONFACK [REQsent] id 1 len 10 IPCP: Address 155.5 CDPCP: I CONFACK [ACKsent] id 1 len 4 CDPCP: State is Open Copyright © 2008 Internetwork Expert 186 www.CCIE R&S Lab Workbook Volume I Version 5.100:1645.45.4 (0x03069B012D04) IPCP: State is Open IPCP: Install route to 155.0 RADIUS: RADIUS: RADIUS: RADIUS: RADIUS: RADIUS: RADIUS: User-Name CHAP-Password NAS-Port NAS-Port-Id NAS-Port-Type Service-Type NAS-IP-Address [1] [3] [5] [87] [61] [6] [4] 8 19 6 13 6 6 6 "R5CHAP" * 10000 "Serial0/1/0" Sync Framed 155. Authenticated User CHAP: O SUCCESS id 7 len 4 PPP: Phase is UP IPCP: O CONFREQ [Closed] id 1 len 10 IPCP: Address 155.1646) for id 1645/1 Retransmit to (155.INE.1.146.45.1.45.1646) for id 1645/1 RADIUS: No response from (155.com .1.146.146.4 (0x03069B012D04) CDPCP: O CONFREQ [Closed] id 1 len 4 PPP: Process pending ncp packets IPCP: I CONFREQ [REQsent] id 1 len 10 IPCP: Address 155.1.45.1.100:1645.5 (0x03069B012D05) CDPCP: I CONFREQ [REQsent] id 1 len 4 CDPCP: O CONFACK [REQsent] id 1 len 4 IPCP: I CONFACK [ACKsent] id 1 len 10 IPCP: Address 155.1.1646) for id 1645/1 RADIUS/DECODE: No response from radius-server. RADIUS: RADIUS: Se0/1/0 Se0/1/0 Se0/1/0 Retransmit to (155.100:1645.1.1.146.1.parse response. FAIL Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: Received LOGIN Response PASS PPP: Phase is FORWARDING. parse response.

Unauthenticated User Copyright © 2008 Internetwork Expert 187 www. The server is not accessible and thus R5 falls back to local authentication.0 Bridging & Switching Now observe the fallback from TACACS+ authentication to the local database in R5: RSRack1R5#debug ppp authentication PPP authentication debugging is on RSRack1R5#debug ppp negotiation PPP protocol negotiation debugging is on RSRack1R5#debug aaa authentication AAA Authentication debugging is on RSRack1R5#debug tacacs TACACS access control debugging is on RSRack1R5#debug tacacs packet TACACS+ packets debugging is on AAA/BIND(0000004E): Bind i/f Serial0/1/0 Se0/1/0 PPP: Using default call direction Se0/1/0 PPP: Treating connection as a dedicated line Se0/1/0 PPP: Session handle[FD000029] Session id[80] Se0/1/0 PPP: Phase is ESTABLISHING. R4 sends loging credentials for PAP and R5 attempts to contact the TACACS+ server.com . by both I AUTH-REQ id 4 len 16 from "R4PPP" Authenticating peer R4PPP Phase is FORWARDING. Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: PAP: PAP: PPP: PPP: Phase is AUTHENTICATING.CCIE R&S Lab Workbook Volume I Version 5. Active Open Se0/1/0 PPP: Authorization NOT required Se0/1/0 LCP: O CONFREQ [Closed] id 5 len 14 Se0/1/0 LCP: AuthProto PAP (0x0304C023) Se0/1/0 LCP: MagicNumber 0x18A58BB5 (0x050618A58BB5) Se0/1/0 LCP: I CONFREQ [REQsent] id 17 len 14 Se0/1/0 LCP: AuthProto PAP (0x0304C023) Se0/1/0 LCP: MagicNumber 0x1AED6797 (0x05061AED6797) Se0/1/0 LCP: O CONFNAK [REQsent] id 17 len 9 Se0/1/0 LCP: AuthProto CHAP (0x0305C22305) Se0/1/0 LCP: I CONFACK [REQsent] id 5 len 14 Se0/1/0 LCP: AuthProto PAP (0x0304C023) Se0/1/0 LCP: MagicNumber 0x18A58BB5 (0x050618A58BB5) Se0/1/0 LCP: I CONFREQ [ACKrcvd] id 18 len 15 Se0/1/0 LCP: AuthProto CHAP (0x0305C22305) Se0/1/0 LCP: MagicNumber 0x1AED6797 (0x05061AED6797) Se0/1/0 LCP: O CONFACK [ACKrcvd] id 18 len 15 Se0/1/0 LCP: AuthProto CHAP (0x0305C22305) Se0/1/0 LCP: MagicNumber 0x1AED6797 (0x05061AED6797) Se0/1/0 LCP: State is Open Authentication starts here. Attempting Forward Phase is AUTHENTICATING.INE.

1.5 (0x03069B012D05) IPCP: State is Open IPCP: Install route to 155.com . Authenticated User PAP: O AUTH-ACK id 4 len 5 AUTH: Timeout 1 CHAP: Using hostname from interface CHAP CHAP: Using password from AAA CHAP: O RESPONSE id 8 len 27 from "R5CHAP" CHAP: I SUCCESS id 8 len 4 PPP: Phase is UP IPCP: O CONFREQ [Closed] id 1 len 10 IPCP: Address 155.0 Bridging & Switching AAA/AUTHEN/PPP (0000004E): Pick method list 'default' Se0/1/0 PPP: Sent PAP LOGIN Request TPLUS: Queuing AAA Authentication request 78 for processing Se0/1/0 CHAP: I CHALLENGE id 8 len 27 from "R4CHAP" AAA/AUTHEN/PPP (0000004E): Pick method list 'default' TPLUS: processing authentication start request id 78 TPLUS: Authentication start packet created for 78(R4PPP) TPLUS: Using server 155.45.45.45.4 (0x03069B012D04) IPCP: O CONFACK [REQsent] id 1 len 10 IPCP: Address 155.200 TPLUS(0000004E)/0: Connect Error No route to host Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 Se0/1/0 PPP: Received LOGIN Response PASS PPP: Phase is FORWARDING.45.5 (0x03069B012D05) CDPCP: O CONFREQ [Closed] id 1 len 4 PPP: Process pending ncp packets IPCP: I CONFREQ [REQsent] id 1 len 10 IPCP: Address 155.CCIE R&S Lab Workbook Volume I Version 5. Attempting Forward CHAP: Using hostname from interface CHAP CHAP: Using password from AAA CHAP: O RESPONSE id 8 len 27 from "R5CHAP" PPP: Phase is AUTHENTICATING.1.200 TPLUS(0000004E)/0: Connect Error No route to host TPLUS: Queuing AAA Authentication request 78 for processing TPLUS: processing authentication start request id 78 TPLUS: Authentication start packet created for 78(R4CHAP) TPLUS: Using server 155.1.1.45.1.146.146.1.4 CDPCP: I CONFACK [ACKsent] id 1 len 4 CDPCP: State is Open Copyright © 2008 Internetwork Expert 188 www.4 (0x03069B012D04) CDPCP: I CONFREQ [REQsent] id 1 len 4 CDPCP: O CONFACK [REQsent] id 1 len 4 IPCP: I CONFACK [ACKsent] id 1 len 10 IPCP: Address 155.INE.1.

Use R3’s interface Fa0/1 and R5’s sub-interface Fa0/1.3 from the pool. If the client accepts the offer. You may limit the amount of incoming PPPoE sessions per Copyright © 2008 Internetwork Expert 189 www.X. You may configure the default BBA group – the global one which applies to all interfaces configured for PPPoE termination or created named groups tuned for various settings and applied to different interfaces. R5 should allocate an IP address to R3 from the local DHCP pool for the subnet 155. an extension is needed to discover the server willing to terminate the PPP link. R5 should authenticate R3 using CHAP and the password value of CISCO. PPP allows for replicating the single-user/single-session paradigm on multiple-access networks. When a PPPoE client starts.com .INE. Essentially it’s just a PPP session being run on top of Ethernet segment inside the regular frames. R5 should block any host attempting to initiate more than 10 sessions in a minute for 5 minutes.54 to accomplish this. which greatly simplifies deployment as it allows for reusing the existing billing systems and expertise.50 PPPoE • • • • • • • Configure R3 as a PPPoE client and R5 as the PPPoE server. Since PPP as a point-to-point protocol and Ethernet is a multiple-access segment. used in DSL and cable networks.CCIE R&S Lab Workbook Volume I Version 5.35. it sends out a Request packet (much like during DHCP negotiation) to the server requesting the PPP service. The most common broadband PPP implementation is PPP over Ethernet or PPPoE. You are allowed to create an additional VLAN 54 for this task.0 Bridging & Switching 1. If the server agrees to the request. it responds with a PADS (Session-confirmation) packet and the client and server start exchanging PPP packets inside Ethernet frames performing normal PPP session negotiation.0. If there is a PPPoE server on the segment it responds with a PADO (PPPoE Active Discovery Offer Packet) to the MAC address of the client initiating the session. In the older IOS versions configuring PPPoE server would require using vpdn (virtual prviaten dialin network) commands.X. Make sure R3 is assigned the IP address 155. Configuration Note One of the widest uses for PPP is broadcast access.35. The recent IOS versions introduced new syntax just for PPPoE configuration using the command mode bba-group which stands for broadband aggregation group. it enters the discovery phase by sending out a broadcast PADI (PPPoE Active Discovery Initiation) packet.

Aside from the optional features. This could be fixed using the command ip tcp adjust-mss 1452 (or lower) on the virtual interface (e. The virtual-template is used to clone the actual virtual-access interfaces for every connecting user. Since PPP is being run over Ethernet. OSPF may fail to negotiate across the virtual link due to MTU mismatch. The PPPoE client configuration in the IOS router is straightforward – you define a dialer interface. 2) PMTU discovery may fail due to firewall filtering and TCP sessions may not work properly. there is probably just one mandatory configuration settings – configuring a virtual-template interface and associating it with the bba-group. on the dialer) in the client router.0 Bridging & Switching interface/sub-interface using the command pppoe max-sessions. which is not needed with DHCP. Notice that only the client is configured with the statement ip address dhcp – there is no need to configure any peer default ip address settings in the server interface. The default Ethernet MTU is 1500 and the PPPoE header adds extra 8 bytes to PPP frames encapsulated inside Ethernet frames. Normally. R3: interface Dialer1 ip address dhcp encapsulation ppp dialer pool 1 ppp chap hostname R3PPP ppp chap password CISCO ! interface FastEthernet0/1 no ip address no shutdown pppoe enable pppoe-client dial-pool-number 1 Copyright © 2008 Internetwork Expert 190 www. However. You may define PPP authentication settings and other native PPP options under the virtual-template interface. the following issues may arise: 1) Some IGP protocols e. as this engages IPCP address allocation mechanism. if a router is used as a PPPoE client. Pay attention to the special “trick” we’re using to allocate the IP address to the connecting client via DHCP.CCIE R&S Lab Workbook Volume I Version 5. The DHCP pool is configured with an exclusion to allocate only a single desired IP address. MTU limitations arise.INE. You may see the example in the solution below.g.g. configure it for PPP and addressing and bind it to a physical interface using dialer pool.com . a client host like PC would account for the overhead and properly set the MSS option in outgoing TCP connections. This could be fixed using the command ip ospf mtuignore with OSPF or by setting the MTU value manually at both endpoints.

After this.35.0 ppp authentication chap PPPOE SW3: vlan 35 ! interface fastEthernet 0/3 switchport host switchport access vlan 35 ! interface FastEthernet 0/5 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast trunk Verification Note Debug PPPoE packets exchange along with the PPP session packets in R4.1 155.255.1.com . RSRack1R3#debug pppoe packets PPPoE control packets debugging is on RSRack1R3#debug pppoe events PPPoE protocol events debugging is on Copyright © 2008 Internetwork Expert 191 www.35.255.254 ! ip dhcp pool PPPOE network 155.255.1.35.1.INE.35. clear the active PPPoE sessions.0 ! interface FastEthernet 0/1 no shutdown ! interface FastEthernet0/1.1.1 255.35.1.2 ip dhcp excluded-address 155.255.1.0 R5: aaa authentication ppp PPPOE local username R3PPP password CISCO ! ip dhcp excluded-address 155.4 155.0 255.35.CCIE R&S Lab Workbook Volume I Version 5.35 encapsulation dot1Q 35 pppoe enable group PPPOE Bridging & Switching ! ! Define per-MAC throttling settings under the BBA group ! bba-group pppoe PPPOE virtual-template 1 sessions per-mac throttle 10 60 300 ! interface Virtual-Template 1 encapsulation ppp ip address 155.

1a68.1 The router sends initial PADI packet out: Sending PADI: Interface = FastEthernet0/1 pppoe_send_padi: FF FF FF FF FF FF 00 11 20 93 E5 61 88 63 11 09 00 00 00 0C 01 01 00 00 01 03 00 04 84 4F 7E 70 .e561 Fa0/1 00 13 1A 68 B0 4D 00 11 20 93 E5 61 88 63 11 A7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .com .2093..1a68.0 RSRack1R3#debug ppp negotiation PPP protocol negotiation debugging is on RSRack1R3#clear pppoe all RSRack1R3# Bridging & Switching The session is being terminated using PADT packet: Vi1 PPP: Outbound cdp packet dropped [0]PPPoE 16: O PADT R:0013. %LINK-3-UPDOWN: Interface Virtual-Access1.35. RSRack1R3# %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1.2093..e561 Fa0/1 PPPoE: Returning Vaccess Virtual-Access1 Vi1 PPP: Block vaccess from being freed [0x10] Di1 IPCP: Remove route to 155.1.. changed state to down Copyright © 2008 Internetwork Expert 192 www..e561 Fa0/1 00 11 20 93 E5 61 00 13 1A 68 B0 4D 88 63 11 07 00 00 00 2D 01 01 00 00 01 03 00 04 84 4F 7E 70 ..1.1a68.35.1 %DIALER-6-UNBIND: Interface Vi1 unbound from profile Di1 [0]PPPoE 16: Destroying R:0013. The server finally confirms the session: PPPoE 0: I PADO R:0013.b04d L:0011. changed state to down RSRack1R3# Vi1 Vi1 Vi1 Vi1 Vi1 Vi1 Vi1 Vi1 Vi1 Vi1 PPP: Sending Acct Event[Down] id[3] CDPCP: State is Closed IPCP: State is Closed PPP: Unlocked by [0x10] Still Locked by [0x2] PPP: Phase is TERMINATING LCP: State is Closed PPP: Phase is DOWN PPP SSS: Send DISCONNECT to mgr_hdl[BA000001] PPP: Unlocked by [0x2] Still Locked by [0x0] PPP: Free previously blocked vaccess The server responds with an offer and the client requests a session.INE. Vi1 IPCP: Remove link info for cef entry 155..2093.CCIE R&S Lab Workbook Volume I Version 5.b04d L:0011.b04d L:0011.

IN PADS from PPPoE Session %DIALER-6-BIND: Interface Vi1 bound to profile Di1 PPPoE: Virtual Access interface obtained. The server still suggests MRU of 1500 because it does not account for PPPoE overhead.b04d L:0011.e561 Fa0/1 00 11 20 93 E5 61 00 13 1A 68 B0 4D 88 63 11 65 00 11 00 2D 01 01 00 00 01 03 00 04 84 4F 7E 70 .0 Bridging & Switching OUT PADR from PPPoE Session 00 13 1A 68 B0 4D 00 11 20 93 E5 61 88 63 11 19 00 00 00 2D 01 01 00 00 01 03 00 04 84 4F 7E 70 . by the peer CHAP: I CHALLENGE id 1 len 30 from "RSRack1R5" CHAP: Using hostname from interface CHAP CHAP: Using password from interface CHAP CHAP: O RESPONSE id 1 len 26 from "R3PPP" Copyright © 2008 Internetwork Expert 193 www. Notice one special configuration request of MRU (maximum receive unit) of 1492 which is because of the PPPoE header of 8 bytes. Setup Vi1 PPP: Using dialer call direction Vi1 PPP: Treating connection as a callout Vi1 PPP: Session handle[8E000008] Session id[0] Now the regular PPP session starts. changed state to up Vi1 LCP: I CONFREQ [REQsent] id 1 len 19 Vi1 LCP: MRU 1492 (0x010405D4) Vi1 LCP: AuthProto CHAP (0x0305C22305) Vi1 LCP: MagicNumber 0x190C2819 (0x0506190C2819) Vi1 LCP: O CONFNAK [REQsent] id 1 len 8 Vi1 LCP: MRU 1500 (0x010405DC) Vi1 LCP: I CONFACK [REQsent] id 1 len 10 Vi1 LCP: MagicNumber 0x170E8640 (0x0506170E8640) Vi1 LCP: I CONFREQ [ACKrcvd] id 2 len 19 Vi1 LCP: MRU 1500 (0x010405DC) Vi1 LCP: AuthProto CHAP (0x0305C22305) Vi1 LCP: MagicNumber 0x190C2819 (0x0506190C2819) Vi1 LCP: O CONFACK [ACKrcvd] id 2 len 19 Vi1 LCP: MRU 1500 (0x010405DC) Vi1 LCP: AuthProto CHAP (0x0305C22305) Vi1 LCP: MagicNumber 0x190C2819 (0x0506190C2819) Vi1 LCP: State is Open This is where R5 authenticates R3 using CHAP: Vi1 Vi1 Vi1 Vi1 Vi1 PPP: Phase is AUTHENTICATING.1a68.. PPPoE : encap string prepared [0]PPPoE 17: data path set to Virtual Acess Vi1 PPP: Phase is DOWN. Active Open Vi1 PPP: No remote authentication for call-out Vi1 LCP: O CONFREQ [Closed] id 1 len 10 Vi1 LCP: MagicNumber 0x170E8640 (0x0506170E8640) %LINK-3-UPDOWN: Interface Virtual-Access1.. PPPoE 17: I PADS R:0013..com ..2093.INE.CCIE R&S Lab Workbook Volume I Version 5. Vi1 PPP: Phase is ESTABLISHING.

3 (0x03069B012303) Vi1 IPCP: State is Open Di1 IPCP: Install route to 155.35.1.e561 UP PPPoE SID 17 RemMAC LocMAC 0013.1.35.1.35.35.35.1 Fa0/1.e561 Port Source VA VA-st Vi1.b04d RSRack1R5#ping 155.1 Vi1 IPCP: Add link info for cef entry 155.35.1. 100-byte ICMP Echos to 155.3 (0x03069B012303) Vi1 CDPCP: O CONFREQ [Closed] id 1 len 4 Vi1 PPP: Process pending ncp packets Vi1 IPCP: Redirect packet to Vi1 Vi1 IPCP: I CONFREQ [REQsent] id 1 len 10 Vi1 IPCP: Address 155.1.1.2093.3 Type escape sequence to abort.1 [0]PPPoE 17: Vi1 O FS Check the session status in R3 and R5 after everything has been established: RSRack1R3#show pppoe session 1 client session Uniq ID State N/A UP 0011. Attempting Forward Vi1 PPP: Queue IPCP code[1] id[1] Vi1 PPP SSS: Receive SSS-Mgr Connect-Local Vi1 PPP: Phase is ESTABLISHING.1a68.1.35.CCIE R&S Lab Workbook Volume I Version 5.2093.1.35 Vt1 Copyright © 2008 Internetwork Expert 194 www. Sending 5.1a68.0 Bridging & Switching Vi1 CHAP: I SUCCESS id 1 len 4 Vi1 PPP: Phase is FORWARDING. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).35.b04d Port Source VA VA-st Vi1 Fa0/1 Di1 RSRack1R5#show pppoe session 1 session in LOCALLY_TERMINATED (PTA) State 1 session total Uniq ID State 98 PTA 0013.1 (0x03069B012301) Vi1 LCP: I PROTREJ [Open] id 3 len 10 protocol CDPCP (0x820701010004) Vi1 CDPCP: State is Closed Vi1 CDPCP: State is Listen Vi1 IPCP: I CONFACK [ACKsent] id 1 len 10 Vi1 IPCP: Address 155.1 (0x03069B012301) Vi1 IPCP: O CONFACK [REQsent] id 1 len 10 Vi1 IPCP: Address 155. Finish LCP Vi1 PPP: Phase is UP Vi1 IPCP: O CONFREQ [Closed] id 1 len 10 Vi1 IPCP: Address 155.3. round-trip min/avg/max = 1/2/4 ms VLAN :35 UP PPPoE SID 17 RemMAC LocMAC 0011.com .INE.

INE.CCIE R&S Lab Workbook Volume I Version 5.0 Bridging & Switching Copyright © 2008 Internetwork Expert 195 www.com .