Bits per sec : 9600
Data bits : 8
Parity : none
Stop bits : 1
Flow control : none
Rarely some routers may require different Bits per second settings. Simply try 1200, 2400 or 4800.
Showing posts with label Switch. Show all posts
Showing posts with label Switch. Show all posts
Sunday, 21 March 2010
Terminal Emulation Settings
This is just a very brief post to list the correct settings that are used to connect to the router or switch using a terminal program such as HyperTerminal and the console cable.
Saturday, 27 February 2010
Configure a Router on a Stick
In this post I will configure a router to route traffic between VLANs using just one router interface, this is commonly referred to as a Router on a Stick.
Below is a diagram of the network I'll be working with in this post.
My goal is for UserA in VLAN 64 to communicate with UserB in VLAN 128. To do this my router and switch must use a fastethernet port running at 100Mb full duplex.
To begin with I will configure the ports on Switch1 to be in the correct VLANs. These commands will also create the VLANs because the don't already exist. I have named the VLANs to be the same as the networks to keep things simple.
Switch1
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#interface range fastEthernet 0/9 - 16
switch1(config-if-range)#switchport access vlan 64
% Access VLAN does not exist. Creating vlan 64
switch1(config-if-range)#exit
switch1(config)#interface range fastEthernet 0/17 - 23
switch1(config-if-range)#switchport access vlan 128
% Access VLAN does not exist. Creating vlan 128
switch1(config-if-range)#end
I have now created the VLANs and I check this with a show command.
switch1#sh vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8
2 dmz active
64 VLAN0064 active Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16
128 VLAN0128 active Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
On switch2 I configure the port that will be connected to the router as a trunk port. I also configure the port to be fixed at 100Mb full duplex.
Switch2
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface fastEthernet 0/2
switch2(config-if)#speed 100
switch2(config-if)#duplex full
switch2(config-if)#switchport mode trunk
switch2(config-if)#end
I check the configuration using a show command. This tells me which interfaces are trunking and for which VLANs.
switch2#sh interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/2 on 802.1q trunking 1
Po5 desirable 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/2 1-4094
Po5 1-4094
Port Vlans allowed and active in management domain
Fa0/2 1-2,64,128
Po5 1-2,64,128
Port Vlans in spanning tree forwarding state and not pruned
Fa0/2 1-2,64,128
Po5 1-2,64,128
On Router2 I create 2 sub-interfaces off the FastEthernet interface (fa0). I name these the same as the VLANs, again to keep thing simple. I also configure the sub-interfaces to support dot1q trunking.
Router2
Router2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router2(config)#interface fastEthernet 0.64
Router2(config-subif)#encapsulation dot1Q 64
Router2(config-subif)#ip address 192.168.1.62 2 55.255.255.192
Router2(config-subif)#no shut
Router2(config-subif)#exit
Router2(config)#interface fastEthernet 0.128
Router2(config-subif)#encapsulation dot1Q 128
Router2(config-subif)#ip address 192.168.1.190 2 55.255.255.192
Router2(config-subif)#no shut
Router2(config-subif)#exit
Once the hosts are configured with valid IP addresses and subnet masks (as shown in the diagram) they are given the default gateway of the IP address that the sub-interface was configured with.
UserA
IP Address - 192.168.1.65
Subnet Mask - 255.255.255.192
Default Gateway - 192.168.1.126
UserB
IP Address - 192.168.1.129
Subnet Mask - 255.255.255.192
Default Gateway - 192.168.1.190
Now I will be able communicate between the hosts in the 2 VLANs.
Below is a diagram of the network I'll be working with in this post.
My goal is for UserA in VLAN 64 to communicate with UserB in VLAN 128. To do this my router and switch must use a fastethernet port running at 100Mb full duplex.
To begin with I will configure the ports on Switch1 to be in the correct VLANs. These commands will also create the VLANs because the don't already exist. I have named the VLANs to be the same as the networks to keep things simple.
Switch1
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#interface range fastEthernet 0/9 - 16
switch1(config-if-range)#switchport access vlan 64
% Access VLAN does not exist. Creating vlan 64
switch1(config-if-range)#exit
switch1(config)#interface range fastEthernet 0/17 - 23
switch1(config-if-range)#switchport access vlan 128
% Access VLAN does not exist. Creating vlan 128
switch1(config-if-range)#end
I have now created the VLANs and I check this with a show command.
switch1#sh vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8
2 dmz active
64 VLAN0064 active Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16
128 VLAN0128 active Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
On switch2 I configure the port that will be connected to the router as a trunk port. I also configure the port to be fixed at 100Mb full duplex.
Switch2
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface fastEthernet 0/2
switch2(config-if)#speed 100
switch2(config-if)#duplex full
switch2(config-if)#switchport mode trunk
switch2(config-if)#end
I check the configuration using a show command. This tells me which interfaces are trunking and for which VLANs.
switch2#sh interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/2 on 802.1q trunking 1
Po5 desirable 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/2 1-4094
Po5 1-4094
Port Vlans allowed and active in management domain
Fa0/2 1-2,64,128
Po5 1-2,64,128
Port Vlans in spanning tree forwarding state and not pruned
Fa0/2 1-2,64,128
Po5 1-2,64,128
On Router2 I create 2 sub-interfaces off the FastEthernet interface (fa0). I name these the same as the VLANs, again to keep thing simple. I also configure the sub-interfaces to support dot1q trunking.
Router2
Router2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router2(config)#interface fastEthernet 0.64
Router2(config-subif)#encapsulation dot1Q 64
Router2(config-subif)#ip address 192.168.1.62 2 55.255.255.192
Router2(config-subif)#no shut
Router2(config-subif)#exit
Router2(config)#interface fastEthernet 0.128
Router2(config-subif)#encapsulation dot1Q 128
Router2(config-subif)#ip address 192.168.1.190 2 55.255.255.192
Router2(config-subif)#no shut
Router2(config-subif)#exit
Once the hosts are configured with valid IP addresses and subnet masks (as shown in the diagram) they are given the default gateway of the IP address that the sub-interface was configured with.
UserA
IP Address - 192.168.1.65
Subnet Mask - 255.255.255.192
Default Gateway - 192.168.1.126
UserB
IP Address - 192.168.1.129
Subnet Mask - 255.255.255.192
Default Gateway - 192.168.1.190
Now I will be able communicate between the hosts in the 2 VLANs.
Saturday, 13 February 2010
Documenting a Network with CDP
In this post I will use the information available from CDP to help me create a logical network diagram.
CDP is the Cisco Discovery Protocol and is enabled on all router and switch interfaces by default. The switch or router sends a CDP packet out of each interface every 60 seconds, any connected device records the delivery of these packets into a CDP table for a holdtime period of 180 seconds. If after 180 seconds the device has not received any more CDP packets on that interface it removes the entry from the table. CDP can be disabled entirely or on any individual interface.
I begin by connecting to my switch and I check the CDP settings.
switch1#sh cdp
Global CDP information:
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 seconds
Sending CDPv2 advertisements is enabled
From the output I can see the CDP time settings and the version. Next I look at the connected devices.
switch1#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch2.lab.localFas 0/1 160 S I WS-C2950-2Fas 0/1
switch2.lab.localFas 0/24 160 S I WS-C2950-2Fas 0/24
Here I can see that I have 2 ports (1 & 24) connected to switch2 (also using ports 1 & 24). I can also see that switch2 is a Catalyst 2950.
This is a great summary but for my diagram I could do with knowing the IP address of switch2.
switch1#sh cdp entry *
-------------------------
Device ID: switch2.lab.local
Entry address(es):
IP address: 10.0.1.211
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/1, Port ID (outgoing port): FastEthernet0/1
Holdtime : 142 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(13)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Tue 04-Mar-03 02:14 by yenanh
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000CCE3E3EC0FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
-------------------------
Device ID: switch2.lab.local
Entry address(es):
IP address: 10.0.1.211
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/24, Port ID (outgoing port): FastEthernet0/24
Holdtime : 142 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(13)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Tue 04-Mar-03 02:14 by yenanh
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000CCE3E3EC0FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
This detailed output gives me additional useful information such as the VLAN and the IOS version.
Next I head over to switch2 and look at it's CDP information.
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 168 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 168 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/2 175 R Cisco C831Eth 0
router1.lab.localFas 0/23 175 R Cisco C831Eth 1
Here I can see the connections to switch1 and additional connections to router1. Again I look at the detailed information to get the IP address of the router.
switch2#sh cdp entry *
-------------------------
Device ID: switch1
Entry address(es):
IP address: 10.0.1.210
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/24, Port ID (outgoing port): FastEthernet0/24
Holdtime : 152 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(12c)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sun 24-Nov-02 23:31 by antonino
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000C8582C600FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
-------------------------
Device ID: switch1
Entry address(es):
IP address: 10.0.1.210
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/1, Port ID (outgoing port): FastEthernet0/1
Holdtime : 152 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(12c)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sun 24-Nov-02 23:31 by antonino
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000C8582C600FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
-------------------------
Device ID: router1.lab.local
Entry address(es):
IP address: 10.0.2.254
Platform: Cisco C831, Capabilities: Router
Interface: FastEthernet0/23, Port ID (outgoing port): Ethernet1
Holdtime : 176 sec
Version :
Cisco IOS Software, C831 Software (C831-K9O3Y6-M), Version 12.4(4)T1, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 22-Dec-05 01:39 by ccai
advertisement version: 2
Duplex: half
-------------------------
Device ID: router1.lab.local
Entry address(es):
IP address: 10.0.1.254
Platform: Cisco C831, Capabilities: Router
Interface: FastEthernet0/2, Port ID (outgoing port): Ethernet0
Holdtime : 176 sec
Version :
Cisco IOS Software, C831 Software (C831-K9O3Y6-M), Version 12.4(4)T1, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 22-Dec-05 01:39 by ccai
advertisement version: 2
Duplex: full
From the output I am able to determine the IP addresses of the connected router interfaces and I can also see that one interface is configured to half duplex. Now I have some good information to begin populating my diagram with.
From here I would probably move to the router and look at the CDP table. But supposing I want to prevent CDP packets from leaving an interface? After all, quite detailed information is included in CDP that you might not want everyone to view.
I connect to the device that I want to stop sending CDP packets and turn CDP off on that particular interface. In my case I would like to stop router1 from sending CDP packets on interface ethernet 1.
router1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
router1(config)#int ethernet 1
router1(config-if)#no cdp enable
router1(config-if)#end
Now when I check the switch that router1 is connected to I see that the holdtime decreases as the switch receives no CDP packet on the interface until after 180 seconds it reaches 0 and the entry is removed from the table.
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 159 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 159 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/23 6 R Cisco C831Eth 1
router1.lab.localFas 0/2 126 R Cisco C831Eth 0
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 153 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 152 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/23 0 R Cisco C831Eth 1
router1.lab.localFas 0/2 179 R Cisco C831Eth 0
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 147 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 147 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/2 174 R Cisco C831Eth 0
CDP is the Cisco Discovery Protocol and is enabled on all router and switch interfaces by default. The switch or router sends a CDP packet out of each interface every 60 seconds, any connected device records the delivery of these packets into a CDP table for a holdtime period of 180 seconds. If after 180 seconds the device has not received any more CDP packets on that interface it removes the entry from the table. CDP can be disabled entirely or on any individual interface.
I begin by connecting to my switch and I check the CDP settings.
switch1#sh cdp
Global CDP information:
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 seconds
Sending CDPv2 advertisements is enabled
From the output I can see the CDP time settings and the version. Next I look at the connected devices.
switch1#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch2.lab.localFas 0/1 160 S I WS-C2950-2Fas 0/1
switch2.lab.localFas 0/24 160 S I WS-C2950-2Fas 0/24
Here I can see that I have 2 ports (1 & 24) connected to switch2 (also using ports 1 & 24). I can also see that switch2 is a Catalyst 2950.
This is a great summary but for my diagram I could do with knowing the IP address of switch2.
switch1#sh cdp entry *
-------------------------
Device ID: switch2.lab.local
Entry address(es):
IP address: 10.0.1.211
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/1, Port ID (outgoing port): FastEthernet0/1
Holdtime : 142 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(13)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Tue 04-Mar-03 02:14 by yenanh
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000CCE3E3EC0FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
-------------------------
Device ID: switch2.lab.local
Entry address(es):
IP address: 10.0.1.211
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/24, Port ID (outgoing port): FastEthernet0/24
Holdtime : 142 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(13)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Tue 04-Mar-03 02:14 by yenanh
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000CCE3E3EC0FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
This detailed output gives me additional useful information such as the VLAN and the IOS version.
Next I head over to switch2 and look at it's CDP information.
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 168 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 168 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/2 175 R Cisco C831Eth 0
router1.lab.localFas 0/23 175 R Cisco C831Eth 1
Here I can see the connections to switch1 and additional connections to router1. Again I look at the detailed information to get the IP address of the router.
switch2#sh cdp entry *
-------------------------
Device ID: switch1
Entry address(es):
IP address: 10.0.1.210
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/24, Port ID (outgoing port): FastEthernet0/24
Holdtime : 152 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(12c)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sun 24-Nov-02 23:31 by antonino
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000C8582C600FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
-------------------------
Device ID: switch1
Entry address(es):
IP address: 10.0.1.210
Platform: cisco WS-C2950-24, Capabilities: Switch IGMP
Interface: FastEthernet0/1, Port ID (outgoing port): FastEthernet0/1
Holdtime : 152 sec
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(12c)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sun 24-Nov-02 23:31 by antonino
advertisement version: 2
Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF01022505000000000000000C8582C600FF0000
VTP Management Domain: 'lab.local'
Native VLAN: 1
Duplex: full
-------------------------
Device ID: router1.lab.local
Entry address(es):
IP address: 10.0.2.254
Platform: Cisco C831, Capabilities: Router
Interface: FastEthernet0/23, Port ID (outgoing port): Ethernet1
Holdtime : 176 sec
Version :
Cisco IOS Software, C831 Software (C831-K9O3Y6-M), Version 12.4(4)T1, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 22-Dec-05 01:39 by ccai
advertisement version: 2
Duplex: half
-------------------------
Device ID: router1.lab.local
Entry address(es):
IP address: 10.0.1.254
Platform: Cisco C831, Capabilities: Router
Interface: FastEthernet0/2, Port ID (outgoing port): Ethernet0
Holdtime : 176 sec
Version :
Cisco IOS Software, C831 Software (C831-K9O3Y6-M), Version 12.4(4)T1, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 22-Dec-05 01:39 by ccai
advertisement version: 2
Duplex: full
From the output I am able to determine the IP addresses of the connected router interfaces and I can also see that one interface is configured to half duplex. Now I have some good information to begin populating my diagram with.
From here I would probably move to the router and look at the CDP table. But supposing I want to prevent CDP packets from leaving an interface? After all, quite detailed information is included in CDP that you might not want everyone to view.
I connect to the device that I want to stop sending CDP packets and turn CDP off on that particular interface. In my case I would like to stop router1 from sending CDP packets on interface ethernet 1.
router1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
router1(config)#int ethernet 1
router1(config-if)#no cdp enable
router1(config-if)#end
Now when I check the switch that router1 is connected to I see that the holdtime decreases as the switch receives no CDP packet on the interface until after 180 seconds it reaches 0 and the entry is removed from the table.
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 159 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 159 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/23 6 R Cisco C831Eth 1
router1.lab.localFas 0/2 126 R Cisco C831Eth 0
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 153 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 152 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/23 0 R Cisco C831Eth 1
router1.lab.localFas 0/2 179 R Cisco C831Eth 0
switch2#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
switch1 Fas 0/24 147 S I WS-C2950-2Fas 0/24
switch1 Fas 0/1 147 S I WS-C2950-2Fas 0/1
router1.lab.localFas 0/2 174 R Cisco C831Eth 0
Tuesday, 9 February 2010
Duplex Configuration
Mismatched duplex settings can cause a network connection to perform poorly. Often a duplex mismatch is caused by a PC's network card or routers interface being configured to full or half duplex whilst the switch port being set to auto detect. If there is a duplex mismatch the CDP will report it, and these can be seen on screen by enabling the terminal monitor.
Below I have enabled terminal monitor and error messages are printed to the terminal.
switch1#terminal monitor
switch1#
03:16:25: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/23 (not half duplex), with router1.lab.local Ethernet1 (half duplex).
switch1#
03:17:25: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/23 (not half duplex), with router1.lab.local Ethernet1 (half duplex).
switch1#
I can see that every 60 seconds as CDP packets are received I receive a warning that there is a duplex mismatch.
To very quickly check all the ports on my switch I use the following show command:
switch1#show interfaces status
Port Name Status Vlan Duplex Speed Type
Fa0/1 connected trunk a-full a-100 10/100BaseTX
Fa0/2 connected 1 a-full a-100 10/100BaseTX
Fa0/3 connected 1 a-full a-100 10/100BaseTX
Fa0/4 notconnect 1 auto auto 10/100BaseTX
Fa0/5 notconnect 1 auto auto 10/100BaseTX
Fa0/6 notconnect 1 auto auto 10/100BaseTX
Fa0/7 notconnect 1 auto auto 10/100BaseTX
Fa0/8 notconnect 1 auto auto 10/100BaseTX
Fa0/9 notconnect 1 auto auto 10/100BaseTX
Fa0/10 notconnect 1 auto auto 10/100BaseTX
Fa0/11 notconnect 1 auto auto 10/100BaseTX
Fa0/12 notconnect 1 auto auto 10/100BaseTX
Fa0/13 notconnect 1 auto auto 10/100BaseTX
Fa0/14 notconnect 1 auto auto 10/100BaseTX
Fa0/15 notconnect 1 auto auto 10/100BaseTX
Fa0/16 notconnect 1 full auto 10/100BaseTX
Fa0/17 notconnect 2 auto auto 10/100BaseTX
Fa0/18 notconnect 2 auto auto 10/100BaseTX
Fa0/19 notconnect 2 auto auto 10/100BaseTX
Fa0/20 notconnect 2 auto auto 10/100BaseTX
Fa0/21 notconnect 2 auto auto 10/100BaseTX
Fa0/22 notconnect 2 auto auto 10/100BaseTX
Fa0/23 connected 2 full 10 10/100BaseTX
Fa0/24 connected trunk a-full a-100 10/100BaseTX
Po5 connected trunk a-full a-100
From the output I can see that although most ports are set to auto, some are configured with specific speed and duplex settings. Fa0/1,2,3 and fa0/24 are configured to auto for duplex and speed but have detected that the connect devices are set to full duplex and 100Mb.
Fa0/16 is configured as full duplex and the speed is set to auto. Fa0/23 which is the port which is shown in the error message is configured as full duplex and 10Mb.
03:17:25: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/23 (not half duplex), with router1.lab.local Ethernet1 (half duplex).
Upon closer inspection of the error message I can see that the connected device (router1) is configured to half duplex on interface Ethernet 1.
I can either change the router interface or the switch port so the duplex settings match but when I do the port will briefly shutdown. I decide to make the change on the router so both ports are configured to full duplex.
After connecting to router1 I can use a show command to take a good look at the interface settings and the counters.
router1#show interfaces ethernet 1
Ethernet1 is up, line protocol is up
Hardware is PQUICC_FEC, address is 000e.3884.8540 (bia 000e.3884.8540)
Internet address is 10.0.2.254/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Half-duplex, 10Mb/s
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:06, output 00:00:06, output hang never
Last clearing of "show interface" counters 23:42:46
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
3182 packets input, 362199 bytes, 0 no buffer
Received 1581 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
9407 packets output, 644928 bytes, 0 underruns
35 output errors, 377 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
From the output above I can see that the interface is configured as half duplex and 10Mb. I change the interface to full duplex to match the switch interface. I can also see that there are some errors and collisions on the interface.
router1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
router1(config)#interface ethernet 1
router1(config-if)#duplex full
router1(config-if)#end
I verify the configuration and reset the counters on both interfaces so I can easily see if more issues occur.
router1#clear counters ethernet 1
Clear "show interface" counters on this interface [confirm]
router1#
switch1#clear counters fastEthernet0/23
Clear "show interface" counters on this interface [confirm]
switch1#
04:00:19: %CLEAR-5-COUNTERS: Clear counter on interface FastEthernet0/23 by vty0 (10.0.1.4)
It is always a good idea to configure interfaces on both servers and routers to match those of the switch rather than leave them at auto detect.
Below I have enabled terminal monitor and error messages are printed to the terminal.
switch1#terminal monitor
switch1#
03:16:25: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/23 (not half duplex), with router1.lab.local Ethernet1 (half duplex).
switch1#
03:17:25: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/23 (not half duplex), with router1.lab.local Ethernet1 (half duplex).
switch1#
I can see that every 60 seconds as CDP packets are received I receive a warning that there is a duplex mismatch.
To very quickly check all the ports on my switch I use the following show command:
switch1#show interfaces status
Port Name Status Vlan Duplex Speed Type
Fa0/1 connected trunk a-full a-100 10/100BaseTX
Fa0/2 connected 1 a-full a-100 10/100BaseTX
Fa0/3 connected 1 a-full a-100 10/100BaseTX
Fa0/4 notconnect 1 auto auto 10/100BaseTX
Fa0/5 notconnect 1 auto auto 10/100BaseTX
Fa0/6 notconnect 1 auto auto 10/100BaseTX
Fa0/7 notconnect 1 auto auto 10/100BaseTX
Fa0/8 notconnect 1 auto auto 10/100BaseTX
Fa0/9 notconnect 1 auto auto 10/100BaseTX
Fa0/10 notconnect 1 auto auto 10/100BaseTX
Fa0/11 notconnect 1 auto auto 10/100BaseTX
Fa0/12 notconnect 1 auto auto 10/100BaseTX
Fa0/13 notconnect 1 auto auto 10/100BaseTX
Fa0/14 notconnect 1 auto auto 10/100BaseTX
Fa0/15 notconnect 1 auto auto 10/100BaseTX
Fa0/16 notconnect 1 full auto 10/100BaseTX
Fa0/17 notconnect 2 auto auto 10/100BaseTX
Fa0/18 notconnect 2 auto auto 10/100BaseTX
Fa0/19 notconnect 2 auto auto 10/100BaseTX
Fa0/20 notconnect 2 auto auto 10/100BaseTX
Fa0/21 notconnect 2 auto auto 10/100BaseTX
Fa0/22 notconnect 2 auto auto 10/100BaseTX
Fa0/23 connected 2 full 10 10/100BaseTX
Fa0/24 connected trunk a-full a-100 10/100BaseTX
Po5 connected trunk a-full a-100
From the output I can see that although most ports are set to auto, some are configured with specific speed and duplex settings. Fa0/1,2,3 and fa0/24 are configured to auto for duplex and speed but have detected that the connect devices are set to full duplex and 100Mb.
Fa0/16 is configured as full duplex and the speed is set to auto. Fa0/23 which is the port which is shown in the error message is configured as full duplex and 10Mb.
03:17:25: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/23 (not half duplex), with router1.lab.local Ethernet1 (half duplex).
Upon closer inspection of the error message I can see that the connected device (router1) is configured to half duplex on interface Ethernet 1.
I can either change the router interface or the switch port so the duplex settings match but when I do the port will briefly shutdown. I decide to make the change on the router so both ports are configured to full duplex.
After connecting to router1 I can use a show command to take a good look at the interface settings and the counters.
router1#show interfaces ethernet 1
Ethernet1 is up, line protocol is up
Hardware is PQUICC_FEC, address is 000e.3884.8540 (bia 000e.3884.8540)
Internet address is 10.0.2.254/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Half-duplex, 10Mb/s
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:06, output 00:00:06, output hang never
Last clearing of "show interface" counters 23:42:46
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
3182 packets input, 362199 bytes, 0 no buffer
Received 1581 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
9407 packets output, 644928 bytes, 0 underruns
35 output errors, 377 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
From the output above I can see that the interface is configured as half duplex and 10Mb. I change the interface to full duplex to match the switch interface. I can also see that there are some errors and collisions on the interface.
router1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
router1(config)#interface ethernet 1
router1(config-if)#duplex full
router1(config-if)#end
I verify the configuration and reset the counters on both interfaces so I can easily see if more issues occur.
router1#clear counters ethernet 1
Clear "show interface" counters on this interface [confirm]
router1#
switch1#clear counters fastEthernet0/23
Clear "show interface" counters on this interface [confirm]
switch1#
04:00:19: %CLEAR-5-COUNTERS: Clear counter on interface FastEthernet0/23 by vty0 (10.0.1.4)
It is always a good idea to configure interfaces on both servers and routers to match those of the switch rather than leave them at auto detect.
Monday, 8 February 2010
Schedule a Reload
Occasionally I might make changes to a switch or router that may lock me out. If I am sat next to the device this isn't a problem, if I am not it is. By scheduling a reboot or reload I can be sure that the change I make is removed when the device reloads because it will reload the startup-config which I saved at the start of the session.
First I save the running configuration to make sure the startup-config is current. I then schedule my reload to allow me enough time to make my changes. If the reload isn't required I simply cancel it.
switch1#copy run start
Destination filename [startup-config]?
Building configuration...
[OK]
switch1#reload in 015
Reload scheduled in 15 minutes
Proceed with reload? [confirm]
switch1#reload cancel
switch1#
***
*** --- SHUTDOWN ABORTED ---
***
switch1#
First I save the running configuration to make sure the startup-config is current. I then schedule my reload to allow me enough time to make my changes. If the reload isn't required I simply cancel it.
switch1#copy run start
Destination filename [startup-config]?
Building configuration...
[OK]
switch1#reload in 015
Reload scheduled in 15 minutes
Proceed with reload? [confirm]
switch1#reload cancel
switch1#
***
*** --- SHUTDOWN ABORTED ---
***
switch1#
Sunday, 7 February 2010
Configure Port Protection
Port Protection can be utilised to protect hosts from malware and abuse. By placing ports into protected mode the connected hosts are unable to talk to other hosts connected to ports that are also in protected mode.
Hosts connected to ports in protected mode can communicate with hosts on non-protected ports. Typically hosts offering services should not be connected to ports that have been placed in protected mode.
Below I configure ports 9 to 16 as protected ports. I use a show command to view the running config.
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface range fastEthernet 0/9 - 16
switch2(config-if-range)#switchport protected
switch2(config-if-range)#end
switch2#show run | begin interface FastEthernet0/9
interface FastEthernet0/9
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/10
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/11
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/12
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/13
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/14
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/15
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/16
switchport protected
no ip address
spanning-tree portfast
!
Using ping I verify that hosts on protected ports cannot communicate with each other but can still access services on non-protected ports.
Hosts connected to ports in protected mode can communicate with hosts on non-protected ports. Typically hosts offering services should not be connected to ports that have been placed in protected mode.
Below I configure ports 9 to 16 as protected ports. I use a show command to view the running config.
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface range fastEthernet 0/9 - 16
switch2(config-if-range)#switchport protected
switch2(config-if-range)#end
switch2#show run | begin interface FastEthernet0/9
interface FastEthernet0/9
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/10
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/11
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/12
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/13
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/14
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/15
switchport protected
no ip address
spanning-tree portfast
!
interface FastEthernet0/16
switchport protected
no ip address
spanning-tree portfast
!
Using ping I verify that hosts on protected ports cannot communicate with each other but can still access services on non-protected ports.
Configure Logging
In this post I will configure my switch to log to a syslog server on my mac (10.0.1.4)
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#logging trap debugging
switch1(config)#logging 10.0.1.4
switch1(config)#logging on
Switch1 now logs to a remote syslog server.
# tail -f /var/log/switch.log
Feb 7 15:11:55 10.0.1.210 35: 00:09:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to down
Feb 7 15:12:00 10.0.1.210 36: 00:09:53: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to up
Feb 7 15:12:03 10.0.1.210 37: 00:09:55: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to up
A switch can also be configured to log to the buffer. Below I will configure Switch2 to log notification messages to the buffer. Finally I will use a show command to view the messages.
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#logging buffered notifications
switch2(config)#end
switch2#show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
Console logging: level debugging, 23 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level notifications, 1 messages logged
Exception Logging: size (4096 bytes)
File logging: disabled
Trap logging: level informational, 27 message lines logged
Log Buffer (4096 bytes):
00:37:19: %SYS-5-CONFIG_I: Configured from console by vty0 (10.0.1.4)
To configure the mac as a syslog server follow the instructions below.
1. Amend syslog.conf
# echo "local7.debug /var/log/switch.log" >> /etc/syslog.conf
2. Create new log file
# touch /var/log/switch.log
3. Change syslogd startup procedure by uncommenting the section (at the end) to accept remote logging in /System/Library/LaunchDaemons/com.apple.syslogd.plist
4. Restart syslogd
# launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
# launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist
5. Allow syslog (/usr/bin/syslog) through the firewall.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#logging trap debugging
switch1(config)#logging 10.0.1.4
switch1(config)#logging on
Switch1 now logs to a remote syslog server.
# tail -f /var/log/switch.log
Feb 7 15:11:55 10.0.1.210 35: 00:09:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to down
Feb 7 15:12:00 10.0.1.210 36: 00:09:53: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to up
Feb 7 15:12:03 10.0.1.210 37: 00:09:55: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to up
A switch can also be configured to log to the buffer. Below I will configure Switch2 to log notification messages to the buffer. Finally I will use a show command to view the messages.
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#logging buffered notifications
switch2(config)#end
switch2#show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
Console logging: level debugging, 23 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level notifications, 1 messages logged
Exception Logging: size (4096 bytes)
File logging: disabled
Trap logging: level informational, 27 message lines logged
Log Buffer (4096 bytes):
00:37:19: %SYS-5-CONFIG_I: Configured from console by vty0 (10.0.1.4)
To configure the mac as a syslog server follow the instructions below.
1. Amend syslog.conf
# echo "local7.debug /var/log/switch.log" >> /etc/syslog.conf
2. Create new log file
# touch /var/log/switch.log
3. Change syslogd startup procedure by uncommenting the section (at the end) to accept remote logging in /System/Library/LaunchDaemons/com.apple.syslogd.plist
4. Restart syslogd
# launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
# launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist
5. Allow syslog (/usr/bin/syslog) through the firewall.
Saturday, 6 February 2010
Configure a SPAN Port
In this post I will create a SPAN port on my switch to send a copy of all sent and received traffic from port 10 to port 13.
switch1(config)#monitor session 1 source interface fastEthernet 0/10 both
switch1(config)#monitor session 1 destination interface fastEthernet 0/13
switch1(config)#end
I verify the configuration with a show command.
switch1#show monitor session 1
Session 1
---------
Type : Local Session
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/10
Source VLANs:
RX Only: None
TX Only: None
Both: None
Source RSPAN VLAN: None
Destination Ports: Fa0/13
Encapsulation: Native
Reflector Port: None
Filter VLANs: None
Dest RSPAN VLAN: None
switch1(config)#monitor session 1 source interface fastEthernet 0/10 both
switch1(config)#monitor session 1 destination interface fastEthernet 0/13
switch1(config)#end
I verify the configuration with a show command.
switch1#show monitor session 1
Session 1
---------
Type : Local Session
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/10
Source VLANs:
RX Only: None
TX Only: None
Both: None
Source RSPAN VLAN: None
Destination Ports: Fa0/13
Encapsulation: Native
Reflector Port: None
Filter VLANs: None
Dest RSPAN VLAN: None
Friday, 5 February 2010
Configure EtherChannel
In this post I will configure 2 ports on 2 switches to be an EtherChannel. This effectively bundles the lines to increase bandwidth and allows any link in the bundle to fail without affecting service.
The diagram below shows the layout of the switches.
Before starting I make sure all interfaces that I will be configuring for EtherChannel have no configuration and are in the same VLAN.
I use the following commands to configure EtherChannel on the switches.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#interface fastEthernet 0/1
switch1(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch1(config-if)#exit
switch1(config)#interface fastEthernet 0/24
switch1(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch1(config-if)#end
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface fastEthernet 0/1
switch2(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch2(config-if)#exit
switch2(config)#interface fastEthernet 0/24
switch2(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch2(config-if)#end
I verify the configuration by checking the running config.
switch2#sh run
Building configuration...
Current configuration : 2447 bytes
!
------cut------
!
interface Port-channel5
no ip address
flowcontrol send off
!
interface FastEthernet0/1
no ip address
channel-group 5 mode desirable
!
-----cut--------
!
interface FastEthernet0/24
no ip address
channel-group 5 mode desirable
When I ping the remote switch and disconnect a cable I have no packet loss.
I also use the following useful show command to view EtherChannel information.
switch1#sh etherchannel summary
Flags: D - down P - in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
u - unsuitable for bundling
U - in use f - failed to allocate aggregator
d - default port
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
5 Po5(SU) PAgP Fa0/1(Pd) Fa0/24(P)
The diagram below shows the layout of the switches.
Before starting I make sure all interfaces that I will be configuring for EtherChannel have no configuration and are in the same VLAN.
I use the following commands to configure EtherChannel on the switches.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#interface fastEthernet 0/1
switch1(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch1(config-if)#exit
switch1(config)#interface fastEthernet 0/24
switch1(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch1(config-if)#end
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface fastEthernet 0/1
switch2(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch2(config-if)#exit
switch2(config)#interface fastEthernet 0/24
switch2(config-if)#channel-group 5 mode desirable
Creating a port-channel interface Port-channel 5
switch2(config-if)#end
I verify the configuration by checking the running config.
switch2#sh run
Building configuration...
Current configuration : 2447 bytes
!
------cut------
!
interface Port-channel5
no ip address
flowcontrol send off
!
interface FastEthernet0/1
no ip address
channel-group 5 mode desirable
!
-----cut--------
!
interface FastEthernet0/24
no ip address
channel-group 5 mode desirable
When I ping the remote switch and disconnect a cable I have no packet loss.
I also use the following useful show command to view EtherChannel information.
switch1#sh etherchannel summary
Flags: D - down P - in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
u - unsuitable for bundling
U - in use f - failed to allocate aggregator
d - default port
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
5 Po5(SU) PAgP Fa0/1(Pd) Fa0/24(P)
Spanning Tree Protocol
In this post I'll be checking that Spanning Tree is working correctly between Switch1 and Switch2. Finally I will configure the non-Root Bridge as the Root and verify the configuration.
The switches are connected as shown in the diagram below.
I check the switches to determine which is the root switch.
switch1#show spanning-tree root
Root Hello Max Fwd
Vlan Root ID Cost Time Age Dly Root Port
---------------- -------------------- --------- ----- --- --- ------------
VLAN0001 32769 000c.8582.c600 0 2 20 15
VLAN0002 32770 000c.8582.c600 0 2 20 15
switch1#show spanning-tree summary
Root bridge for: VLAN0001, VLAN0002.
Extended system ID is enabled.
PortFast BPDU Guard is disabled
EtherChannel misconfiguration guard is enabled
UplinkFast is disabled
BackboneFast is disabled
Default pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 4 4
VLAN0002 0 0 0 2 2
---------------------- -------- --------- -------- ---------- ----------
2 vlans 0 0 0 6 6
I can see this (Switch1) is the root bridge for both VLANs. As this is the root bridge I check a non-root bridge (Switch2) to see which ports are in blocking mode.
switch2#sh spanning-tree blockedports
Name Blocked Interfaces List
-------------------- ------------------------------------
VLAN0001 Fa0/24
VLAN0002 Fa0/24
Number of blocked ports (segments) in the system : 2
From the output I can determine that port Fa0/24 on Switch2 is in blocking mode.
To test Spanning Tree is working I ping Switch2 from a PC connected to Switch1 and disconnect the uplink on fa0/1
MacBook:~ syn$ ping 10.0.1.211
PING 10.0.1.211 (10.0.1.211): 56 data bytes
64 bytes from 10.0.1.211: icmp_seq=0 ttl=255 time=22.273 ms
64 bytes from 10.0.1.211: icmp_seq=1 ttl=255 time=4.341 ms
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
--------cut----------
Request timeout for icmp_seq 27
Request timeout for icmp_seq 28
Request timeout for icmp_seq 29
Request timeout for icmp_seq 30
Request timeout for icmp_seq 31
Request timeout for icmp_seq 32
64 bytes from 10.0.1.211: icmp_seq=33 ttl=255 time=4.376 ms
64 bytes from 10.0.1.211: icmp_seq=34 ttl=255 time=4.117 ms
64 bytes from 10.0.1.211: icmp_seq=35 ttl=255 time=4.111 ms
^C
--- 10.0.1.211 ping statistics ---
36 packets transmitted, 5 packets received, 86.1% packet loss
round-trip min/avg/max/stddev = 4.111/7.844/22.273/7.216 ms
As can be seen from the ping results it takes 30 seconds for STP to converge and failover to port Fa0/24
switch2#sh spanning-tree root
Root Hello Max Fwd
Vlan Root ID Cost Time Age Dly Root Port
---------------- -------------------- ------ ----- --- --- ----------------
VLAN0001 32769 000c.8582.c600 19 2 20 15 Fa0/24
VLAN0002 32770 000c.8582.c600 19 2 20 15 Fa0/24
Reconnecting the uplink cable causes STP to failover back to the Fa0/1 because Fa0/1 has the lowest priority.
To view detailed information about Spanning Tree on a ports use the following show command.
switch2#show spanning-tree active detail
------cut---------
Port 24 (FastEthernet0/24) of VLAN0002 is blocking
Port path cost 19, Port priority 128, Port Identifier 128.24.
Designated root has priority 32770, address 000c.8582.c600
Designated bridge has priority 32770, address 000c.8582.c600
Designated port id is 128.24, designated path cost 0
Timers: message age 2, forward delay 0, hold 0
Number of transitions to forwarding state: 4
Link type is point-to-point by default
BPDU: sent 8, received 8232
Here I can see the ports priority details, timers and how many times the port has transitioned into a forwarding state.
To configure Switch2 as the Root Bridge for both VLAN's I use the following command.
switch2(config)#spanning-tree vlan 1-2 root primary
I verify this with the following show command.
switch2#show spanning-tree summary
Switch is in pvst mode
Root bridge for: VLAN0001-VLAN0002
EtherChannel misconfiguration guard is enabled
Extended system ID is enabled
Portfast is disabled by default
PortFast BPDU Guard is disabled by default
Portfast BPDU Filter is disabled by default
Loopguard is disabled by default
UplinkFast is disabled
BackboneFast is disabled
Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 3 3
VLAN0002 0 0 0 3 3
---------------------- -------- --------- -------- ---------- ----------
2 vlans 0 0 0 6 6
Switch1 being the non-Root Bridge now has interfaces in blocking state.
switch1#show spanning-tree blockedports
Name Blocked Interfaces List
-------------------- ------------------------------------
VLAN0001 Fa0/24
VLAN0002 Fa0/24
Number of blocked ports (segments) in the system : 2
The switches are connected as shown in the diagram below.
I check the switches to determine which is the root switch.
switch1#show spanning-tree root
Root Hello Max Fwd
Vlan Root ID Cost Time Age Dly Root Port
---------------- -------------------- --------- ----- --- --- ------------
VLAN0001 32769 000c.8582.c600 0 2 20 15
VLAN0002 32770 000c.8582.c600 0 2 20 15
switch1#show spanning-tree summary
Root bridge for: VLAN0001, VLAN0002.
Extended system ID is enabled.
PortFast BPDU Guard is disabled
EtherChannel misconfiguration guard is enabled
UplinkFast is disabled
BackboneFast is disabled
Default pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 4 4
VLAN0002 0 0 0 2 2
---------------------- -------- --------- -------- ---------- ----------
2 vlans 0 0 0 6 6
I can see this (Switch1) is the root bridge for both VLANs. As this is the root bridge I check a non-root bridge (Switch2) to see which ports are in blocking mode.
switch2#sh spanning-tree blockedports
Name Blocked Interfaces List
-------------------- ------------------------------------
VLAN0001 Fa0/24
VLAN0002 Fa0/24
Number of blocked ports (segments) in the system : 2
From the output I can determine that port Fa0/24 on Switch2 is in blocking mode.
To test Spanning Tree is working I ping Switch2 from a PC connected to Switch1 and disconnect the uplink on fa0/1
MacBook:~ syn$ ping 10.0.1.211
PING 10.0.1.211 (10.0.1.211): 56 data bytes
64 bytes from 10.0.1.211: icmp_seq=0 ttl=255 time=22.273 ms
64 bytes from 10.0.1.211: icmp_seq=1 ttl=255 time=4.341 ms
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
--------cut----------
Request timeout for icmp_seq 27
Request timeout for icmp_seq 28
Request timeout for icmp_seq 29
Request timeout for icmp_seq 30
Request timeout for icmp_seq 31
Request timeout for icmp_seq 32
64 bytes from 10.0.1.211: icmp_seq=33 ttl=255 time=4.376 ms
64 bytes from 10.0.1.211: icmp_seq=34 ttl=255 time=4.117 ms
64 bytes from 10.0.1.211: icmp_seq=35 ttl=255 time=4.111 ms
^C
--- 10.0.1.211 ping statistics ---
36 packets transmitted, 5 packets received, 86.1% packet loss
round-trip min/avg/max/stddev = 4.111/7.844/22.273/7.216 ms
As can be seen from the ping results it takes 30 seconds for STP to converge and failover to port Fa0/24
switch2#sh spanning-tree root
Root Hello Max Fwd
Vlan Root ID Cost Time Age Dly Root Port
---------------- -------------------- ------ ----- --- --- ----------------
VLAN0001 32769 000c.8582.c600 19 2 20 15 Fa0/24
VLAN0002 32770 000c.8582.c600 19 2 20 15 Fa0/24
Reconnecting the uplink cable causes STP to failover back to the Fa0/1 because Fa0/1 has the lowest priority.
To view detailed information about Spanning Tree on a ports use the following show command.
switch2#show spanning-tree active detail
------cut---------
Port 24 (FastEthernet0/24) of VLAN0002 is blocking
Port path cost 19, Port priority 128, Port Identifier 128.24.
Designated root has priority 32770, address 000c.8582.c600
Designated bridge has priority 32770, address 000c.8582.c600
Designated port id is 128.24, designated path cost 0
Timers: message age 2, forward delay 0, hold 0
Number of transitions to forwarding state: 4
Link type is point-to-point by default
BPDU: sent 8, received 8232
Here I can see the ports priority details, timers and how many times the port has transitioned into a forwarding state.
To configure Switch2 as the Root Bridge for both VLAN's I use the following command.
switch2(config)#spanning-tree vlan 1-2 root primary
I verify this with the following show command.
switch2#show spanning-tree summary
Switch is in pvst mode
Root bridge for: VLAN0001-VLAN0002
EtherChannel misconfiguration guard is enabled
Extended system ID is enabled
Portfast is disabled by default
PortFast BPDU Guard is disabled by default
Portfast BPDU Filter is disabled by default
Loopguard is disabled by default
UplinkFast is disabled
BackboneFast is disabled
Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 3 3
VLAN0002 0 0 0 3 3
---------------------- -------- --------- -------- ---------- ----------
2 vlans 0 0 0 6 6
Switch1 being the non-Root Bridge now has interfaces in blocking state.
switch1#show spanning-tree blockedports
Name Blocked Interfaces List
-------------------- ------------------------------------
VLAN0001 Fa0/24
VLAN0002 Fa0/24
Number of blocked ports (segments) in the system : 2
Thursday, 4 February 2010
Configure VTP
In this post I will configure VTP. I will be working with Switch1 and Switch2. I will configure port fa0/9 on each switch as a trunk port, configure VTP for the domain lab.local with a VTP password of cisco. I will configure Switch2 to be a VTP Client. Finally I will verify VTP is working with some useful show and debugging commands.
Switch 1
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#int fastEthernet 0/9
switch1(config-if)#switchport mode trunk
switch1(config-if)#exit
switch1(config)#vtp domain lab.local
Changing VTP domain name from NULL to lab.local
switch1(config)#vtp password cisco
Setting device VLAN database password to cisco.
switch1(config)#end
switch1#sh vtp status
VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 64
Number of existing VLANs : 6
VTP Operating Mode : Server
VTP Domain Name : lab.local
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0x12 0xBF 0xAA 0x37 0xDC 0x26 0xF2 0x03
Configuration last modified by 10.0.1.210 at 3-1-93 03:11:00
Local updater ID is 10.0.1.210 on interface Vl1 (lowest numbered VLAN interface found)
Switch2
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface fastEthernet 0/9
switch2(config-if)#switchport mode trunk
switch2(config-if)#exit
switch2(config)#vtp domain lab.local
Changing VTP domain name from NULL to lab.local
switch2(config)#vtp password cisco
Setting device VLAN database password to cisco
switch2(config)#vtp mode client
Setting device to VTP CLIENT mode.
switch2(config)#end
switch2#sh vtp status
VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 64
Number of existing VLANs : 6
VTP Operating Mode : Client
VTP Domain Name : lab.local
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0x12 0xBF 0xAA 0x37 0xDC 0x26 0xF2 0x03
Configuration last modified by 10.0.1.210 at 3-1-93 03:11:00
Turn on debugging for VTP events on Switch2
switch2#terminal monitor
switch2#debug sw-vlan vtp events
vtp events debugging is on
Create a new VLAN on Switch1
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#vlan 3
switch1(config-vlan)#name test-vlan
switch1(config-vlan)#end
Switch2 displays the VTP events.
00:11:10: VTP LOG RUNTIME: Summary packet received, domain = lab.local, rev = 1, followers = 1
00:11:10: VTP LOG RUNTIME: Summary packet rev 1 greater than domain lab.local rev 0
00:11:10: VTP LOG RUNTIME: Domain lab.local currently not in updating state
00:11:10: VTP LOG RUNTIME: Subset packet received, domain = lab.local, rev = 1, seq = 1, length = 244
00:11:10: VTP LOG RUNTIME: Transmit vtp summary, domain lab.local, rev 1, followers 1
MD5 digest calculated = C5 62 5F 4A 7B 07 69 C7 0E CD E9 42 0E 7C AF 5C
I verify that the VTP revision number has incremented on switch2
switch2#sh vtp status
VTP Version : 2
Configuration Revision : 1
Maximum VLANs supported locally : 64
Number of existing VLANs : 7
VTP Operating Mode : Client
VTP Domain Name : lab.local
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0xC5 0x62 0x5F 0x4A 0x7B 0x07 0x69 0xC7
Configuration last modified by 10.0.1.210 at 3-1-93 00:20:13
Attempts to create a VLAN on switch2 fails as it is in Client mode
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#vlan 4
VTP VLAN configuration not allowed when device is in CLIENT mode.
Switch 1
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#int fastEthernet 0/9
switch1(config-if)#switchport mode trunk
switch1(config-if)#exit
switch1(config)#vtp domain lab.local
Changing VTP domain name from NULL to lab.local
switch1(config)#vtp password cisco
Setting device VLAN database password to cisco.
switch1(config)#end
switch1#sh vtp status
VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 64
Number of existing VLANs : 6
VTP Operating Mode : Server
VTP Domain Name : lab.local
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0x12 0xBF 0xAA 0x37 0xDC 0x26 0xF2 0x03
Configuration last modified by 10.0.1.210 at 3-1-93 03:11:00
Local updater ID is 10.0.1.210 on interface Vl1 (lowest numbered VLAN interface found)
Switch2
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#interface fastEthernet 0/9
switch2(config-if)#switchport mode trunk
switch2(config-if)#exit
switch2(config)#vtp domain lab.local
Changing VTP domain name from NULL to lab.local
switch2(config)#vtp password cisco
Setting device VLAN database password to cisco
switch2(config)#vtp mode client
Setting device to VTP CLIENT mode.
switch2(config)#end
switch2#sh vtp status
VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 64
Number of existing VLANs : 6
VTP Operating Mode : Client
VTP Domain Name : lab.local
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0x12 0xBF 0xAA 0x37 0xDC 0x26 0xF2 0x03
Configuration last modified by 10.0.1.210 at 3-1-93 03:11:00
Turn on debugging for VTP events on Switch2
switch2#terminal monitor
switch2#debug sw-vlan vtp events
vtp events debugging is on
Create a new VLAN on Switch1
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#vlan 3
switch1(config-vlan)#name test-vlan
switch1(config-vlan)#end
Switch2 displays the VTP events.
00:11:10: VTP LOG RUNTIME: Summary packet received, domain = lab.local, rev = 1, followers = 1
00:11:10: VTP LOG RUNTIME: Summary packet rev 1 greater than domain lab.local rev 0
00:11:10: VTP LOG RUNTIME: Domain lab.local currently not in updating state
00:11:10: VTP LOG RUNTIME: Subset packet received, domain = lab.local, rev = 1, seq = 1, length = 244
00:11:10: VTP LOG RUNTIME: Transmit vtp summary, domain lab.local, rev 1, followers 1
MD5 digest calculated = C5 62 5F 4A 7B 07 69 C7 0E CD E9 42 0E 7C AF 5C
I verify that the VTP revision number has incremented on switch2
switch2#sh vtp status
VTP Version : 2
Configuration Revision : 1
Maximum VLANs supported locally : 64
Number of existing VLANs : 7
VTP Operating Mode : Client
VTP Domain Name : lab.local
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0xC5 0x62 0x5F 0x4A 0x7B 0x07 0x69 0xC7
Configuration last modified by 10.0.1.210 at 3-1-93 00:20:13
Attempts to create a VLAN on switch2 fails as it is in Client mode
switch2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch2(config)#vlan 4
VTP VLAN configuration not allowed when device is in CLIENT mode.
Wednesday, 3 February 2010
Port Security
In this post I will configure a port with port security as sticky port (will learn the first mac address). I then configure the switch to re-enable the port after 2 minutes of shutdown.
Finally I will use some useful show commands to view the interface configuration, state of the port and verify that the correct settings are in the running config.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#interface fastEthernet 0/17
switch1(config-if)#switchport port-security
switch1(config-if)#switchport port-security mac-address sticky
switch1(config-if)#end
switch1(config)#errdisable recovery cause psecure-violation
switch1(config)#errdisable recovery interval 120
switch1#sh run interface fastEthernet 0/17
Building configuration...
Current configuration : 254 bytes
!
interface FastEthernet0/17
switchport access vlan 2
switchport mode access
switchport port-security
switchport port-security mac-address sticky
switchport port-security mac-address sticky 001e.68ff.d35f
no ip address
spanning-tree portfast
end
switch1#show port-security interface fastEthernet 0/17
Port Security : Enabled
Port status : SecureUp
Violation mode : Shutdown
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Aging time : 0 mins
Aging type : Absolute
SecureStatic address aging : Disabled
Security Violation count : 0
switch1#show port-security address
Secure Mac Address Table
-------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age
(mins)
---- ----------- ---- ----- -------------
2 001e.68ff.d35f SecureSticky Fa0/17 -
-------------------------------------------------------------------
Total Addresses in System : 1
Max Addresses limit in System : 1024
switch1#show running-config | include errdisable
errdisable recovery cause psecure-violation
errdisable recovery interval 120
Finally I will use some useful show commands to view the interface configuration, state of the port and verify that the correct settings are in the running config.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#interface fastEthernet 0/17
switch1(config-if)#switchport port-security
switch1(config-if)#switchport port-security mac-address sticky
switch1(config-if)#end
switch1(config)#errdisable recovery cause psecure-violation
switch1(config)#errdisable recovery interval 120
switch1#sh run interface fastEthernet 0/17
Building configuration...
Current configuration : 254 bytes
!
interface FastEthernet0/17
switchport access vlan 2
switchport mode access
switchport port-security
switchport port-security mac-address sticky
switchport port-security mac-address sticky 001e.68ff.d35f
no ip address
spanning-tree portfast
end
switch1#show port-security interface fastEthernet 0/17
Port Security : Enabled
Port status : SecureUp
Violation mode : Shutdown
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Aging time : 0 mins
Aging type : Absolute
SecureStatic address aging : Disabled
Security Violation count : 0
switch1#show port-security address
Secure Mac Address Table
-------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age
(mins)
---- ----------- ---- ----- -------------
2 001e.68ff.d35f SecureSticky Fa0/17 -
-------------------------------------------------------------------
Total Addresses in System : 1
Max Addresses limit in System : 1024
switch1#show running-config | include errdisable
errdisable recovery cause psecure-violation
errdisable recovery interval 120
Tuesday, 2 February 2010
Create a Static Host Mapping
In this post I will create a static host entry for router on the IP address 10.0.1.254. I check the configuration with the show hosts command. Finally I ping 10.0.1.254 using the host name.
switch1#ping router
Translating "router"
% Unrecognized host or address, or protocol not running.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#ip host router 10.0.1.254
switch1(config)#end
switch1#show hosts
Default domain is not set
Name/address lookup uses static mappings
Host Port Flags Age Type Address(es)
router None (perm, OK) 0 IP 10.0.1.254
switch1#ping router
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
switch1#ping router
Translating "router"
% Unrecognized host or address, or protocol not running.
switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
switch1(config)#ip host router 10.0.1.254
switch1(config)#end
switch1#show hosts
Default domain is not set
Name/address lookup uses static mappings
Host Port Flags Age Type Address(es)
router None (perm, OK) 0 IP 10.0.1.254
switch1#ping router
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
Create a MOTD Banner
In this post I will create a MOTD banner for my switch and verify the configuration with a show command.
switch1#conf t
switch1(config)#banner motd $ Authorised Access Only $
switch1(config)#end
switch1#sh run | include banner
banner motd ^C Authorised Access Only ^C
switch1#
switch1#conf t
switch1(config)#banner motd $ Authorised Access Only $
switch1(config)#end
switch1#sh run | include banner
banner motd ^C Authorised Access Only ^C
switch1#
Configure Switch VTY Ports
In this post I will configure all my VTY (Telnet ports) to have logging synchronous and a 30 minute exec timeout (max idle time). I give the ports a password of cisco, configure the switch to require a login on the VTY ports and display the motd banner. Finally I use a show command to check the running config.
switch1#conf t
switch1(config)#line vty 0 15
switch1(config-line)#logging synchronous
switch1(config-line)#exec-timeout 30 0
switch1(config-line)#password cisco
switch1(config-line)#login
switch1(config-line)#motd-banner
switch1(config-line)#end
switch1#sh run | begin line vty
line vty 0 4
exec-timeout 30 0
password 7 01100F175804
logging synchronous
login
line vty 5 15
exec-timeout 30 0
password 7 01100F175804
logging synchronous
login
!
end
switch1#conf t
switch1(config)#line vty 0 15
switch1(config-line)#logging synchronous
switch1(config-line)#exec-timeout 30 0
switch1(config-line)#password cisco
switch1(config-line)#login
switch1(config-line)#motd-banner
switch1(config-line)#end
switch1#sh run | begin line vty
line vty 0 4
exec-timeout 30 0
password 7 01100F175804
logging synchronous
login
line vty 5 15
exec-timeout 30 0
password 7 01100F175804
logging synchronous
login
!
end
Creating a VLAN
In this post I list the commands to create VLAN 2, name it to dmz and place a range of ports in the VLAN. Finally I use a show command to look at the VLAN configuration.
switch1#conf t
switch1(config)#vlan 2
switch1(config-vlan)#name dmz
switch1(config-vlan)#end
switch1#conf t
switch1(config)#interface range FastEthernet 0/17 - 24
switch1(config-if-range)#switchport access vlan 2
switch1(config-if-range)#end
switch1#sh vlan brief
switch1#conf t
switch1(config)#vlan 2
switch1(config-vlan)#name dmz
switch1(config-vlan)#end
switch1#conf t
switch1(config)#interface range FastEthernet 0/17 - 24
switch1(config-if-range)#switchport access vlan 2
switch1(config-if-range)#end
switch1#sh vlan brief
Saturday, 30 January 2010
Show Version
The show version command is very useful. From running the command I can see the following useful pieces of information about my router.
- Model
- Uptime
- IOS Version & software release
- CPU, RAM, NVRAM & Flash details
- Configuration Register setting
Router>show version
Cisco IOS Software, 3600 Software (C3640-JK9S-M), Version 12.4(16), RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Wed 20-Jun-07 11:43 by prod_rel_team
ROM: ROMMON Emulation Microcode
ROM: 3600 Software (C3640-JK9S-M), Version 12.4(16), RELEASE SOFTWARE (fc1)
Router uptime is 1 minute
System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19
System image file is "tftp://255.255.255.255/unknown"
Cisco 3640 (R4700) processor (revision 0xFF) with 124928K/6144K bytes of memory.
Processor board ID 00000000
R4700 CPU at 100MHz, Implementation 33, Rev 1.2
DRAM configuration is 64 bits wide with parity enabled.
125K bytes of NVRAM.
8192K bytes of processor board System flash (Read/Write)
Configuration register is 0x2142
Router>
Subscribe to:
Posts (Atom)
