CCNP – MDH Switchprojekt del 2

Har varit lite dåligt med inlägg på senare tid, har pluggat multicast senaste ~2 veckorna men inte riktigt funnit motivationen att skriva inlägg om de mer teoretiska bitarna då det redan finns så oändligt med info om det redan.

Tänkte istället visa några av lösningarna vi använt oss av i switch-projektet som nämdes i tidigare inlägg.

Topologin ser ut enligt följande:

switchprojekt

Vi kör EIGRP på alla L3-enheter, dvs R1-3, S1 & S3.

MSTP

7. Konfigurera MSTP på alla switchar. Lägg VLAN 10 och 20 till instans 1, och VLAN 30 och 99 till instans 2. Gör S1 till spanning-tree root for instans 1 och backup root för instans 2. S3 skall vara root for instans 2 och backuproot för instans 1.

S1

spanning-tree mode mst
spanning-tree mst configuration
 name cisco
 revision 1
 instance 1 vlan 10, 20
 instance 2 vlan 30, 99
!
spanning-tree mst 1 priority 24576
spanning-tree mst 2 priority 28672

S2

spanning-tree mode mst
spanning-tree mst configuration
 name cisco
 revision 1
 instance 1 vlan 10, 20
 instance 2 vlan 30, 99

S3

spanning-tree mode mst
spanning-tree mst configuration
 name cisco
 revision 1
 instance 1 vlan 10, 20
 instance 2 vlan 30, 99
!
spanning-tree mst 1 priority 28672
spanning-tree mst 2 priority 24576

HSRP

8. S1 och S3 skall vara gateways för VLANen och ni skall använda HSRP för redundans. för access layer hosts i VLANs 10, 20, 30, and 99.
9. S1 skall vara active HSRP router för VLAN 10 och 20 konfigurera S3 som backup. Konfigurera S3 som active router för VLAN 30 och 99 och S1 som backup för dessa VLAN.

S1

interface Vlan10
 description Client
 ip address 172.16.10.1 255.255.255.0
 ip helper-address 172.16.32.193
 standby 1 ip 172.16.10.254
 standby 1 priority 150
 standby 1 preempt
 no shutdown
!
interface Vlan20
 description Voice
 ip address 172.16.20.1 255.255.255.0
 standby 1 ip 172.16.20.254
 standby 1 priority 150
 standby 1 preempt
 no shutdown
!
interface Vlan30
 description Server
 ip address 172.16.30.1 255.255.255.0
 ip helper-address 172.16.32.193
 standby 2 ip 172.16.30.254
 standby 2 priority 80
 no shutdown
! 
interface Vlan99
 description Management
 ip address 172.16.99.1 255.255.255.0
 standby 2 ip 172.16.99.254
 standby 2 priority 80
 no shutdown

S3

interface Vlan10
 description Client
 ip address 172.16.10.3 255.255.255.0
 ip helper-address 172.16.32.193
 standby 1 ip 172.16.10.254
 standby 1 priority 80
 no shutdown
!
interface Vlan20
 description Voice
 ip address 172.16.20.3 255.255.255.0
 standby 1 ip 172.16.20.254
 standby 1 priority 80
 no shutdown
!
interface Vlan30
 description Server
 ip address 172.16.30.3 255.255.255.0
 ip helper-address 172.16.32.193
 standby 2 ip 172.16.30.254
 standby 2 priority 120
 standby 2 preempt
 no shutdown
!
interface Vlan99
 ip address 172.16.99.3 255.255.255.0
 standby 2 ip 172.16.99.254
 standby 2 priority 120
 standby 2 preempt

EIGRP

16. På S1 och S3 ska ni routa med EIGRP, det som skall synas i routingtabellerna på 2800-routrarna är en manuellt summerad adress av de adresser som finns på S1, S2 och S3. Givetvis skall adresser som används på R1, R2 och R3 summeras på lämpligt sätt om man tittar på det i någon av 3560-switcharna.

Fixade en visio-bild så det blir lite tydligare vad det är som efterfrågas:

summary-projekt

Konfigen för S1 & S3 är väldigt simpel.

S1

interface FastEthernet0/5
 description To R1
 no switchport
 ip address 172.16.11.1 255.255.255.0
 ip authentication mode eigrp 1 md5
 ip authentication key-chain eigrp 1 GRPM
 ip summary-address eigrp 1 172.16.0.0 255.255.0.0
 srr-queue bandwidth share 1 30 35 5
 priority-queue out 
 mls qos trust dscp
 auto qos trust 
 speed 100
 duplex full

S3

interface FastEthernet0/5
 description To R1
 no switchport
 ip address 172.16.33.3 255.255.255.0
 ip authentication mode eigrp 1 md5
 ip authentication key-chain eigrp 1 GRPM
 ip summary-address eigrp 1 172.16.0.0 255.255.0.0
 srr-queue bandwidth share 1 30 35 5
 priority-queue out 
 mls qos trust dscp
 spanning-tree portfast
 speed 100
 duplex full

För R1 vill vi endast annonsera 172.16.32.0/24 ner till S1, och 172.16.0.0/16 upp till R2.

interface FastEthernet0/1
 description to S1
 ip address 172.16.11.11 255.255.255.0
 ip authentication mode eigrp 1 md5
 ip authentication key-chain eigrp 1 GRPM
 ip summary-address eigrp 1 172.16.32.0 255.255.255.0 5
 duplex full
 speed 100
 auto qos voip trust 
 service-policy output AutoQoS-Policy-Trust
 no shutdown

För att filtrera bort alla “Connected”-nät och endast annonsera 172.16.0.0/16 till R2 behöver vi dock använda oss av en distribute-list.

interface Serial0/0/0
 description to R2
 bandwidth 256000
 ip address 172.16.32.1 255.255.255.192
 ip authentication mode eigrp 1 md5
 ip authentication key-chain eigrp 1 GRPM
 auto qos voip trust 
 clock rate 256000
 service-policy output AutoQoS-Policy-Trust
 no shutdown

ip prefix-list INTERNAL-R2 seq 5 permit 172.16.0.0/16

router eigrp 1
 passive-interface default
 no passive-interface FastEthernet0/1
 no passive-interface Serial0/0/0
 no passive-interface Serial0/0/1
 network 172.16.0.0 0.0.255.255
 distribute-list prefix INTERNAL-R2 out Serial0/0/0
 no auto-summary

Samma sak gäller för R3.

interface FastEthernet0/1
 description to S1
 ip address 172.16.33.13 255.255.255.0
 ip authentication mode eigrp 1 md5
 ip authentication key-chain eigrp 1 GRPM
 ip summary-address eigrp 1 172.16.32.0 255.255.255.0 5
 duplex full
 speed 100
 auto qos voip trust 
 service-policy output AutoQoS-Policy-Trust
 no shutdown

interface Serial0/0/0
 description to R1
 bandwidth 256000
 ip address 172.16.32.66 255.255.255.192
 ip authentication mode eigrp 1 md5
 ip authentication key-chain eigrp 1 GRPM
 auto qos voip trust 
 clock rate 256000
 service-policy output AutoQoS-Policy-Trust
 no shutdown

ip prefix-list INTERNAL-R2 seq 5 permit 172.16.0.0/16

router eigrp 1
 passive-interface default
 no passive-interface FastEthernet0/1
 no passive-interface Serial0/0/0
 no passive-interface Serial0/0/1 
 network 172.16.0.0 0.0.255.255
 distribute-list prefix INTERNAL-R2 out Serial0/0/1
 no auto-summary

Då jag nu precis börjat läsa CCDP denna vecka samtidigt som CCNP-kursen kan vi nog komma tillbaka till den här topologin och införa lite förbättringar senare. 🙂

TSHOOT – Part IV, Access-layer

tshoot-access

Vi fortsätter från tidigare inlägg där vi avslutade med att konfa upp L3/Routing/Redist. mellan R4 & DSW1 & 2. Innan vi ger oss på att konfa NAT & DHCP så fixar vi klart vårat access-layer först. Är lite osäker på om det ens är möjligt att sätta upp HSRP över switch-modulen men det märker vi väl.. 🙂

Layer 2

För att lägga till VLAN i NM-16ESW måste vi använda legacy-metoden “vlan database”, observera även att vi måste använda “show vlan-switch”.

DSW1

DSW1#vlan database
 DSW1(vlan)#vlan 10
 VLAN 10 added:
 Name: VLAN0010
 DSW1(vlan)#vlan 20
 VLAN 20 added:
 Name: VLAN0020
 DSW1(vlan)#vlan 200
 VLAN 200 added:
 Name: VLAN0200
 DSW1(vlan)#exit
 DSW1(config)#int range fa1/9 - 10
 DSW1(config-if-range)#switchport mode trunk
 DSW1(config-if-range)#switchport trunk encapsulation dot1q
 DSW1(config-if-range)#description to ASW1
 DSW1(config-if-range)#channel-group 1 mode on
 Creating a port-channel interface Port-channel1
 DSW1(config-if-range)#
 DSW1(config)#int range fa1/5 - 6
 DSW1(config-if-range)#switchport trunk encapsulation dot1q
 DSW1(config-if-range)#switchport mode trunk
 DSW1(config-if-range)#descrip to ASW2
 DSW1(config-if-range)#channel-group 4 mode on
 Creating a port-channel interface Port-channel4
 DSW1(config-if-range)#

DSW2

DSW2#vlan database
 DSW2(vlan)#vlan 10
 VLAN 10 added:
 Name: VLAN0010
 DSW2(vlan)#vlan 20
 VLAN 20 added:
 Name: VLAN0020
 DSW2(vlan)#vlan 200
 VLAN 200 added:
 Name: VLAN0200
 DSW2(vlan)#exi
 APPLY completed.
 Exiting....
DSW2(config)#int range fa1/9 - 10
 DSW2(config-if-range)#switchport trunk encaps dot1q
 DSW2(config-if-range)#switchport mode trunk
 DSW2(config-if-range)#desc to ASW2
 DSW2(config-if-range)#channel-group 1 mode on
 Creating a port-channel interface Port-channel1
DSW2(config-if-range)#int range fa1/5 - 6
 DSW2(config-if-range)#switchport trunk encaps dot1q
 DSW2(config-if-range)#switchport mode trunk
 DSW2(config-if-range)#desc to ASW1
 DSW2(config-if-range)#channel-group 5 mode on
 Creating a port-channel interface Port-channel5

ASW1

ASW1#vlan database
 ASW1(vlan)#vlan 10
 VLAN 10 added:
 Name: VLAN0010
 ASW1(vlan)#vlan 20
 VLAN 20 added:
 Name: VLAN0020
 ASW1(vlan)#vlan 200
 VLAN 200 added:
 Name: VLAN0200
 ASW1(vlan)#exit
 APPLY completed.
 Exiting....
ASW1(config)#no ip routing
 ASW1(config)#int range fa1/9 - 10
 ASW1(config-if-range)#switchport trunk encaps dot1q
 ASW1(config-if-range)#switchport mode trunk
 ASW1(config-if-range)#desc to DSW1
 ASW1(config-if-range)#channel-group 1 mode on
 Creating a port-channel interface Port-channel1
ASW1(config)#inte range fa1/5 - 6
 ASW1(config-if-range)#switchport trunk encaps dot1q
 ASW1(config-if-range)#switchport mode trunk
 ASW1(config-if-range)#desc to DSW2
 ASW1(config-if-range)#channel-group 5 mode on
 Creating a port-channel interface Port-channel5

ASW2

ASW2#vlan database
 ASW2(vlan)#vlan 10
 VLAN 10 added:
 Name: VLAN0010
 ASW2(vlan)#vlan 20
 VLAN 20 added:
 Name: VLAN0020
 ASW2(vlan)#vlan 200
 VLAN 200 added:
 Name: VLAN0200
 ASW2(vlan)#exit
 APPLY completed.
 Exiting....
ASW2(config)#no ip routing
 ASW2(config)#int range fa1/9 - 10
 ASW2(config-if-range)#switchport trunk encap dot1q
 ASW2(config-if-range)#switchport mode trunk
 ASW2(config-if-range)#desc to DSW2
 ASW2(config-if-range)#channel-group 1 mode on
 Creating a port-channel interface Port-channel1
ASW2(config-if-range)#int range fa1/5 - 6
 ASW2(config-if-range)#switchport trunk encap dot1q
 ASW2(config-if-range)#switchport mode trunk
 ASW2(config-if-range)#desc to DSW1
 ASW2(config-if-range)#channel-group 4 mode on
 Creating a port-channel interface Port-channel4

Access-ports

ASW1

ASW1(config)#int range fa1/0 - 4
 ASW1(config-if-range)#switchport mode access
 ASW1(config-if-range)#switchport access vlan 10
 ASW1(config-if-range)#description Vlan10

ASW2

ASW2(config)#int range fa1/0 - 4
 ASW2(config-if-range)#switchport mode access
 ASW2(config-if-range)#switchport access vlan 20
 ASW2(config-if-range)#descrip Vlan20

Management-Vlan

DSW1

DSW1(config)#interface vlan 200
 DSW1(config-if)#ip add 192.168.1.129 255.255.255.248
 DSW1(config-if)#desc Management

DSW2

DSW2(config)#interface vlan 200
 DSW2(config-if)#ip add 192.168.1.130 255.255.255.248
 DSW2(config-if)#desc Management

ASW1

ASW1(config)#int vlan 1
 ASW1(config-if)#shut
 ASW1(config-if)#int vlan 200
 ASW1(config-if)#ip add 192.168.1.131 255.255.255.248
 ASW1(config-if)#desc Management

ASW2

ASW2(config-if-range)#ex
 ASW2(config)#int vlan 1
 ASW2(config-if)#shut
 ASW2(config-if)#inte vlan 200
 ASW2(config-if)#ip add 192.168.1.132 255.255.255.248
 ASW2(config-if)#desc Management

MLS Routing

DSW1

DSW1(config)#interface vlan 10
 DSW1(config-if)#ip add 10.2.1.1 255.255.255.0
 DSW1(config-if)#desc Vlan 10, Users
 DSW1(config-if)#interface vlan 20
 DSW1(config-if)#ip add 10.2.2.2 255.255.255.0
 DSW1(config-if)#desc Vlan 20, Servers
 DSW1(config-if)#exit
 DSW1(config)#router eigrp 10
 DSW1(config-router)#network 10.2.1.0 0.0.0.255
 DSW1(config-router)#network 10.2.2.0 0.0.0.255
 DSW1(config-router)#exit

DLSW2

DSW2(config)#interface vlan 10
 DSW2(config-if)#ip add 10.2.1.2 255.255.255.0
 DSW2(config-if)#desc Vlan 10, Users
 DSW2(config-if)#interface vlan 20
 DSW2(config-if)#ip add 10.2.2.1 255.255.255.0
 DSW2(config-if)#desc Vlan 20, Servers
 DSW2(config-if)#exit
 DSW2(config)#router eigrp 10
 DSW2(config-router)#network 10.2.1.0 0.0.0.255
 DSW2(config-router)#network 10.2.2.0 0.0.0.255
 DSW2(config-router)#end

HSRP

Endast Vlan10 använde HSRP och enligt spec. ska DSW1 vara Active, vi sätter därför prion över 100 som annars är default.

DSW1

DSW1(config)#interface vlan 10
 DSW1(config-if)#standby 1 ip 10.2.1.254
 DSW1(config-if)#standby 1 preempt
 DSW1(config-if)#standby 1 priority 150

DSW2

DSW2(config)#interface vlan 10
 DSW2(config-if)#standby 1 ip 10.2.1.254
 DSW2(config-if)#standby 1 preempt
 DSW2(config-if)#standby 1 priority 100
DSW1#sh standby brief
 P indicates configured to preempt.
 |
 Interface Grp Prio P State Active Standby Virtual IP
 Vl10 1 150 P Active local 10.2.1.2 10.2.1.254

Tyvärr verkade det som jag stött på en bugg här.
Klienter kan pinga DSW1’s riktiga IP-adress 10.2.1.1, men inte den virtuella gatewayen.

HostA#ping 10.2.1.254
Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 10.2.1.254, timeout is 2 seconds:
 .....
 Success rate is 0 percent (0/5)

 HostA#ping 10.2.1.1
Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 10.2.1.1, timeout is 2 seconds:
 !!!!!
 Success rate is 100 percent (5/5), round-trip min/avg/max = 12/43/68 ms

Slår vi över till DSW2 istället så fungerar det utan problem märkligt nog.

DSW2(config)#int vlan 10
 DSW2(config-if)#standby 1 prio
 DSW2(config-if)#standby 1 priority 160
 DSW2(config-if)#end
 DSW2#
 *Mar 1 03:58:36.031: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Standby -> Active
 *Mar 1 03:58:36.355: %SYS-5-CONFIG_I: Configured from console by console
HostA#ping 10.2.1.254
Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 10.2.1.254, timeout is 2 seconds:
 !!!!!
 Success rate is 100 percent (5/5), round-trip min/avg/max = 8/16/32 ms
 HostA#ping 10.2.1.1
Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 10.2.1.1, timeout is 2 seconds:
 !!!!!
 Success rate is 100 percent (5/5), round-trip min/avg/max = 12/24/48 ms
 HostA#ping 10.2.1.2
Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 10.2.1.2, timeout is 2 seconds:
 !!!!!
 Success rate is 100 percent (5/5), round-trip min/avg/max = 12/228/1032 ms

Skumt! Verkar inte vara den enda som har samma problem för den delen men har inte lyckats hitta någon vettig lösning på problemet. Har tillsvidare lämnat DSW2 som Active istället, huvudsaken är väl att vi har en “virtuell gateway” till vår host.

Vi har nu åtminstone fullt flöde genom hela nätet!

HostA#ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 100/136/176 ms
HostA#traceroute 10.1.1.1
Type escape sequence to abort.
Tracing the route to 10.1.1.1
1 10.2.1.2 28 msec 56 msec 24 msec
 2 10.1.4.9 64 msec 28 msec 32 msec
 3 10.1.1.9 72 msec 108 msec 68 msec
 4 10.1.1.5 180 msec 120 msec 56 msec
 5 10.1.1.1 152 msec 200 msec 176 msec

Då återstår endast NAT på R1 & DHCP-servern på R4. 🙂 

TSHOOT – Part III, Dist-layer

tshoot-distlayer

Tar och bygger vidare på vårat tshoot-nät med Distribution-layer den här gången. Vi behöver bl.a. konfa upp EIGRP<->OSPF & RIP_NG <->OSPFv3 redistrubution.

Men först måste vi givetvis fixa L2/L3-konfig.. Tyvärr är just switch-funktionen i GNS3 väldigt begränsad (använder endast NM-16ESW-kort i 3640s), så våra port-channel nummer kommer inte stämma överens. Det finns inte heller möjlighet att skapa en L3-channel mellan DSW1 & DSW2 så här blir det endast en port som kommer användas.

Basic L3

R4

R4(config)#inte fa0/0
R4(config-if)#ip add 10.1.4.5 255.255.255.252
R4(config-if)#descrip to DSW1
R4(config-if)#no shut
R4(config-if)#ipv6 add 2026::2:1/122
R4(config-if)#inte fa0/1
R4(config-if)#ip add 10.1.4.9 255.255.255.252
R4(config-if)#desc to DSW2
R4(config-if)#no shut

DSW1

DSW1(config)#ip routing
DSW1(config)#ipv6 unicast-routing
DSW1(config)#int fa0/0
DSW1(config-if)#ip add 10.1.4.6 255.255.255.252
DSW1(config-if)#descrip to R4
DSW1(config-if)#no shut
DSW1(config-if)#ipv6 add 2026::2:2/122
DSW1(config)#int range fa1/13 - 14
DSW1(config-if-range)#descrip L3 Etherchannel to DSW2
DSW1(config-if-range)#no switchport
DSW1(config-if-range)#shut
DSW1(config-if-range)#
DSW1(config-if-range)#inte fa1/13
DSW1(config-if)#ip add 10.2.4.13 255.255.255.252
DSW1(config-if)#ipv6 add 2026::3:1/122
DSW1(config-if)#no shut

DSW2

DSW2(config)#ip routing
DSW2(config)#ipv6 uni
DSW2(config)#ipv6 unicast-routing
DSW2(config)#inte fa0/0
DSW2(config-if)#ip add 10.1.4.10 255.255.255.252
DSW2(config-if)#descrip to R4
DSW2(config-if)#no shut
DSW2(config-if)#int range fa1/13 - 14
DSW2(config-if-range)#descrip L3 Etherchannel to DSW1
DSW2(config-if-range)#no switchport
DSW2(config-if-range)#shut
DSW2(config-if-range)#inte fa1/13
DSW2(config-if)#ip add 10.2.4.14 255.255.255.252
DSW2(config-if)#no shut
DSW2(config-if)#ipv6 add 2026::3:2/122
DSW2(config-if)#exit

EIGRP

R4

R4(config)#router eigrp 10
R4(config-router)#no auto
R4(config-router)#no auto-summary
R4(config-router)#passive-
R4(config-router)#passive-interface default
R4(config-router)#no passive
R4(config-router)#no passive-interface fa0/0
R4(config-router)#no passive-interface fa0/1
R4(config-router)#network 10.1.4.4 0.0.0.3
R4(config-router)#network 10.1.4.8 0.0.0.3

DSW1

DSW1(config)#router eigrp 10
DSW1(config-router)#no auto-summary
DSW1(config-router)#passive-interface default
DSW1(config-router)#no passive-interface fa0/0
DSW1(config-router)#no passive-interface fa1/13
DSW1(config-router)#network 10.1.4.4 0.0.0.3
DSW1(config-router)#network 10.2.4.12 0.0.0.3

DSW2

DSW2(config)#router eigrp 10
DSW2(config-router)#no auto-summary
DSW2(config-router)#passive-interface default
DSW2(config-router)#no passive-interface fa0/0
DSW2(config-router)#no passive-interface fa1/13
DSW2(config-router)#network 10.1.4.8 0.0.0.3
DSW2(config-router)#network 10.2.4.12 0.0.0.3

RIPng

R4

R4(config-router)#inte fa0/0
R4(config-if)#ipv6 rip RIP_ZONE enable
R4(config-if)#int fa0/1
R4(config-if)#ipv6 rip RIP_ZONE enable

DSW1

DSW1(config)#inte fa0/0
DSW1(config-if)#ipv6 rip RIP_ZONE enable
DSW1(config)#int fa1/13
DSW1(config-if)#ipv6 rip RIP_ZONE enable

DSW2

DSW2(config)#inte fa0/0
DSW2(config-if)#ipv6 rip RIP_ZONE enable
DSW2(config)#int fa1/13
DSW2(config-if)#ipv6 rip RIP_ZONE enable

Redistribution

Då vi inte har multipoint-redistribution behöver vi inte använda oss av route-maps/tags i det här fallet.

R4(config)#router eigrp 10
R4(config-router)#redistribute ospf 1 metric 1500 1 255 1 1500
R4(config-router)#router ospf 1
R4(config-router)#redistribute eigrp 10 subnets
R4(config)#ipv6 router ospf 6
R4(config-rtr)#redistribute rip RIP_ZONE include-connected metric 20
R4(config)#ipv6 router rip RIP_ZONE
R4(config-rtr)#redistribute ospf 6 metric 5 include-connected

Verifiering

DSW2#sh ipv6 rip database
RIP process "RIP_ZONE", local RIB
 2026::2:0/122, metric 2, installed
 FastEthernet1/13/FE80::CE03:13FF:FE54:F10D, expires in 165 secs
 2026::3:0/122, metric 2
 FastEthernet1/13/FE80::CE03:13FF:FE54:F10D, expires in 165 secs
 2026::34:0/122, metric 7, installed
 FastEthernet1/13/FE80::CE03:13FF:FE54:F10D, expires in 165 secs
 ::/0, metric 7, installed
 FastEthernet1/13/FE80::CE03:13FF:FE54:F10D, expires in 165 secs

Ping till R1 från DSW2

DSW2#ping ipv6 2026::12:1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2026::12:1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 136/160/200 ms
DSW2#ping 10.1.1.1
Translating "10.1.1.1"
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 52/111/192 ms

Vackert!

En trace till webservern fungerar dock ej:

DSW2#traceroute 209.65.200.241 Translating "209.65.200.241"
Type escape sequence to abort.
 Tracing the route to 209.65.200.241
1 10.1.4.9 16 msec 48 msec 48 msec
 2 10.1.1.9 108 msec 48 msec 44 msec
 3 10.1.1.5 40 msec 80 msec 84 msec
 4 10.1.1.1 140 msec 108 msec 156 msec
 5 * * *

Detta beror helt enkelt på att vi inte konfigurerat upp någon NAT ännu i R1 så trafiken hittar inte tillbaka. Det fixar vi imorgon tillsammans med DHCP-tjänsten & access-layer. 🙂

MDH Lab – Private-VLANs & VACL

Topologi

pvlan

Objectives

  • Secure the server farm using private VLANs.
  • Secure the staff VLAN from the student VLAN.
  • Secure the staff VLAN when temporary staff personnel are used.

Background

In this lab, you will configure the network to protect the VLANs using router ACLs, VLAN ACLs, and private VLANs. First, you will secure the new server farm by using private VLANs so that broadcasts on one server VLAN are not heard by the other server VLAN.

Service providers use private VLANs to separate different customers’ traffic while utilizing the same parent VLAN for all server traffic. The private VLANs provide traffic isolation between devices, even though they might exist on the same VLAN.

You will then secure the staff VLAN from the student VLAN by using a RACL, which prevents traffic from the student VLAN from reaching the staff VLAN. This allows the student traffic to utilize the network and Internet services while keeping the students from accessing any of the staff resources.

Lastly, you will configure a VACL that allows a host on the staff network to be set up to use the VLAN for access but keeps the host isolated from the rest of the staff machines. This machine is used by temporary staff employees.

Genomförande

L2 basic konfig

Då vi ska använda oss av Private-VLANs i den här labben måste vi konfigurera våra switchar till VTP mode Transparent.

S1

Switch(config)#hostname S1
 S1(config)#line con 0
 S1(config-line)#logging sync
 S1(config-line)#!Trunk-links till S2
 S1(config-line)#int range fa0/1 - 2
 S1(config-if-range)#switchport trunk encaps dot1q
 S1(config-if-range)#switchport mode trunk
 S1(config-if-range)#description to S2
 S1(config-if-range)#channel-protocol lacp
 S1(config-if-range)#channel-group 1 mode active
 Creating a port-channel interface Port-channel 1
S1(config-if-range)#
 S1(config-if-range)#!Trunk-links till S3
 S1(config-if-range)#int range fa0/3 - 4
 S1(config-if-range)#switchport trunk encaps dot1q
 S1(config-if-range)#switchport mode trunk
 S1(config-if-range)#description to S2
 S1(config-if-range)#channel-protocol lacp
 S1(config-if-range)#channel-group 2 mode active
 Creating a port-channel interface Port-channel 2
S1(config-if-range)#exit
 S1(config)#vtp mode transparent
 Setting device to VTP TRANSPARENT mode.
S1(config)#vlan 100,150,200
 S1(config-vlan)#exit

S3

Switch(config)#hostname S3
 S3(config)#line con 0
 S3(config-line)#logging sync
 S3(config-line)#!Trunk-links till S2
 S3(config-line)#int range fa0/1 - 2
 S3(config-if-range)#switchport trunk encaps dot1q
 S3(config-if-range)#switchport mode trunk
 S3(config-if-range)#description to S2
 S3(config-if-range)#channel-protocol lacp
 S3(config-if-range)#channel-group 1 mode active
 Creating a port-channel interface Port-channel 1
S3(config-if-range)#
 S3(config-if-range)#!Trunk-links till S1
 S3(config-if-range)#int range fa0/3 - 4
 S3(config-if-range)#switchport trunk encaps dot1q
 S3(config-if-range)#switchport mode trunk
 S3(config-if-range)#description to S1
 S3(config-if-range)#channel-protocol lacp
 S3(config-if-range)#channel-group 2 mode passive
 Creating a port-channel interface Port-channel 2
S3(config-if-range)#exit
 S3(config)#
 S3(config)#vtp mode transparent
 Setting device to VTP Transparent mode for VLANS.
 S3(config)#vlan 100,150,200
 S3(config-vlan)#exit

S2

Switch(config)#hostname S2
 S2(config)#line con 0
 S2(config-line)#logging sync
 S2(config-line)#!Trunk-links till S1
 S2(config-line)#int range fa0/1 - 2
 S2(config-if-range)#switchport mode trunk
 S2(config-if-range)#description to S1
 S2(config-if-range)#channel-protocol lacp
 S2(config-if-range)#channel-group 1 mode passive
 Creating a port-channel interface Port-channel 1
S2(config-if-range)#
 S2(config-if-range)#!Trunk-links till S3
 S2(config-if-range)#int range fa0/3 - 4
 S2(config-if-range)#switchport mode trunk
 S2(config-if-range)#description to S3
 S2(config-if-range)#channel-protocol lacp
 S2(config-if-range)#channel-group 2 mode passive
 Creating a port-channel interface Port-channel 2
S2(config-if-range)#exit
 S2(config)#
S2(config)#vtp mode transparent
Setting device to VTP Transparent mode for VLANS.
S2(config)#vlan 100,150,200
S2(config-vlan)#exit

HSRP

S1

S1(config)#interface vlan 1
 S1(config-if)#ip add 172.16.1.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.1.1
 S1(config-if)#standby 1 preempt
 S1(config-if)#standby 1 priority 100
 S1(config-if)#
 S1(config-if)#interface vlan 100
 S1(config-if)#ip add 172.16.100.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.100.1
 S1(config-if)#standby 1 preempt
 S1(config-if)#standby 1 priority 150
 S1(config-if)#
 S1(config-if)#interface vlan 150
 S1(config-if)#ip add 172.16.150.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.150.1
 S1(config-if)#standby 1 preempt
 S1(config-if)#standby 1 priority 150
 S1(config-if)#
 S1(config-if)#interface vlan 200
 S1(config-if)#ip add 172.16.200.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.200.1
 S1(config-if)#standby 1 preempt
 S1(config-if)#standby 1 priority 100
 S1(config-if)#

S3

S3(config)#interface vlan 1
 S3(config-if)#ip add 172.16.1.30 255.255.255.0
 S3(config-if)#no shut
 S3(config-if)#standby 1 ip 172.16.1.1
 S3(config-if)#standby 1 preempt
 S3(config-if)#standby 1 priority 150
 S3(config-if)#
 S3(config-if)#interface vlan 100
 S3(config-if)#ip add 172.16.100.30 255.255.255.0
 S3(config-if)#standby 1 ip 172.16.100.1
 S3(config-if)#standby 1 preempt
 S3(config-if)#standby 1 priority 100
 S3(config-if)#
 S3(config-if)#interface vlan 150
 S3(config-if)#ip add 172.16.150.30 255.255.255.0
 S3(config-if)#standby 1 ip 172.16.150.1
 S3(config-if)#standby 1 preempt
 S3(config-if)#standby 1 priority 100
 S3(config-if)#
 S3(config-if)#interface vlan 200
 S3(config-if)#ip add 172.16.200.30 255.255.255.0
 S3(config-if)#standby 1 ip 172.16.200.1
 S3(config-if)#standby 1 preempt
 S3(config-if)#standby 1 priority 150
 S3(config-if)#

Verifiering

S1#sh standby brief
 P indicates configured to preempt.
 |
 Interface Grp Pri P State Active Standby Virtual IP
 Vl1 1 100 P Standby 172.16.1.30 local 172.16.1.1
 Vl100 1 150 P Active local 172.16.100.30 172.16.100.1
 Vl150 1 150 P Active local 172.16.150.30 172.16.150.1
 Vl200 1 100 P Standby 172.16.200.30 local 172.16.200.1

Private-VLANs

PVLANs provide layer 2-isolation between ports within the same broadcast domain. There are three types of PVLAN ports:

  • Promiscuous— A promiscuous port can communicate with all interfaces, including the isolated and community ports within a PVLAN.
  • Isolated— An isolated port has complete Layer 2 separation from the other ports within the same PVLAN, but not from the promiscuous ports. PVLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic from isolated port is forwarded only to promiscuous ports.
  • Community— Community ports communicate among themselves and with their promiscuous ports. These interfaces are separated at Layer 2 from all other interfaces in other communities or isolated ports within their PVLAN.

Mer info om just PVLANs och design-rekommendationer finns att läsa här!

Vi börjar med att konfigurera upp våra secondary-vlans (Isolated- & Community-PVLAN) i S1 & S3.

S1(config)#vlan 151
S1(config-vlan)#private-vlan isolated
S1(config-vlan)#exit
S1(config)#!Community
S1(config)#vlan 152
S1(config-vlan)#private-vlan community
S1(config-vlan)#exit
S1(config)#

S3(config)#vlan 151
S3(config-vlan)#private-vlan isolated
S3(config-vlan)#exit
S3(config)#!Community
S3(config)#vlan 152
S3(config-vlan)#private-vlan community
S3(config-vlan)#exit

Vi behöver sedan associera våra PVLAN med “parent”-vlanet 150, “primary:n”.

S1(config)#vlan 150
S1(config-vlan)#private-vlan primary
S1(config-vlan)#private-vlan association 151,152
S1(config-vlan)#exit

S3(config)#vlan 150
S3(config-vlan)#private-vlan primary
S3(config-vlan)#private-vlan association 151,152
S3(config-vlan)#exit

Då vi i detta exemplet använder SVI’s för att routa trafik direkt i switchen behöver vi även knyta våra Secondary-vlan till primaryn (150).

S1(config)#interface vlan 150
S1(config-if)#private-vlan mapping 151,152
S1(config-if)#
*Mar 1 01:35:40.794: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 151
*Mar 1 01:35:40.794: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 152

S3(config)#int vlan 150
S3(config-if)#private-vlan mapping 151,152
S3(config-if)#
*Mar 1 01:35:37.170: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 151
*Mar 1 01:35:37.170: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 152

Verifiera med “show vlan private-vlan”:

S1#sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
150 151 isolated 
150 152 community

Nu återstår det endast att koppla interfacen till respektive secondary-vlan. Enligt uppgiften ska fördelningen se ut enligt följande:

  • Fa0/5-10 – Isolated
  • Fa0/11-15 – Community

S1

S1(config)#int range fa0/5 - 10
S1(config-if-range)#description Isolated-port
S1(config-if-range)#switchport mode private-vlan host
S1(config-if-range)#switchport private-vlan host-association 150 151
S1(config-if-range)#
S1(config-if-range)#int range fa0/11 - 15
S1(config-if-range)#description Community-port
S1(config-if-range)#switchport mode private-vlan host
S1(config-if-range)#switchport private-vlan host-association 150 152

S3

S3(config)#int range fa0/5 - 10
S3(config-if-range)#description Isolated-port
S3(config-if-range)#switchport mode private-vlan host
S3(config-if-range)#switchport private-vlan host-association 150 151
S3(config-if-range)#
S3(config-if-range)#int range fa0/11 - 15
S3(config-if-range)#description Community-port
S3(config-if-range)#switchport mode private-vlan host
S3(config-if-range)#switchport private-vlan host-association 150 152

Verifiering

S3#show vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
150 151 isolated Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10
150 152 community Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15

RACL

Vi skulle även skydda Vlan 200 (172.16.200.0/24) från Vlan 100 (172.16.100.0/24), vilket vi gör enkelt med en vanlig ACL.

S1(config)#ip access-list extended RACL
S1(config-ext-nacl)#deny ip 172.16.100.0 0.0.0.255 172.16.200.0 0.0.0.255
S1(config-ext-nacl)#permit ip any any
S1(config-ext-nacl)#exit
S1(config)#interface vlan 200
S1(config-if)#ip access-group RACL in

S3

S3(config)#ip access-list extended RACL
S3(config-ext-nacl)#deny ip 172.16.100.0 0.0.0.255 172.16.200.0 0.0.0.255
S3(config-ext-nacl)#permit ip any any
S3(config-ext-nacl)#exit
S3(config)#interface vlan 200
S3(config-if)#ip access-group RACL in
S3(config-if)#

VACL

Vlan-ACL är ett nytt koncept i CCNP, mer info finns att läsa här! Istället för att knyta det till ett interface används det istället direkt på VLAN:et, själva konfigureringen påminner väldigt mycket om route-maps som vi använt oss mycket av i tidigare inlägg om ex. route-filtering.

Enligt specifikationen skulle vi blockera hosten 172.16.100.150 från att nå någon annan på vlan 100. Vi skapar först en ACL för att ha något att använda i match-statement.

S1(config)#ip access-list extended VACL-BLOCK
S1(config-ext-nacl)#permit ip host 172.16.100.150 172.16.100.0 0.0.0.255
S1(config-ext-nacl)#exit

S3(config)#ip access-list extended VACL-BLOCK
S3(config-ext-nacl)#permit ip host 172.16.100.150 172.16.100.0 0.0.0.255
S3(config-ext-nacl)#exit

Vi bygger sedan vår VLAN Access-map, glöm inte att utan en match all/permit så blockerar vi all trafik precis som en vanlig ACL.

S1(config)#vlan access-map AM-VACL-BLOCK 10
S1(config-access-map)#match ip addr VACL-BLOCK
S1(config-access-map)#action drop
S1(config-access-map)#exit
S1(config)#vlan access-map AM-VACL-BLOCK 20
S1(config-access-map)#action forward
S1(config-access-map)#exit
S1(config)#

S3(config)#vlan access-map AM-VACL-BLOCK 10
S3(config-access-map)#match ip addr VACL-BLOCK
S3(config-access-map)#action drop
S3(config-access-map)#exit
S3(config)#vlan access-map AM-VACL-BLOCK 20
S3(config-access-map)#action forward
S3(config-access-map)#exit
S3(config)#

Sen återstår det bara att knyta detta till vlan:et.

S1(config)#vlan filter AM-VACL-BLOCK vlan-list 100
S3(config)#vlan filter AM-VACL-BLOCK vlan-list 100

Tyvärr har vi inga host att testa med så vi får helt enkelt räkna med att allt är ok! 😉

MDH Lab – Securing STP

Topologi

stp-secure

Objectives

  • Secure the Layer 2 spanning-tree topology with BPDU guard.
  • Protect the primary and secondary root bridge with root guard.
  • Protect switch ports from unidirectional links with UDLD.

Background

This lab is a continuation of Lab 6-1 and uses the network configuration set up in that lab. In this lab, you will secure the network against possible spanning-tree disruptions, such as rogue access point additions and the loss of stability to the root bridge by the addition of switches to the network.

The improper addition of switches to the network can be either malicious or accidental. In either case, the network can be secured against such a disruption.

Genomförande

Då det är precis samma topologi & HSRP-konfiguration som förra labben använder jag samma konfig nu.

BPDU-Guard

BPDU-guard konfigurerade jag redan i förra labben men vi kan väl ta det igen bara för att repetera.

S2(config)#int range fa0/6 - 20 
S2(config-if-range)#switchport mode access
S2(config-if-range)#switchport access vlan 100
S2(config-if-range)#switchport port-security
S2(config-if-range)#switchport port-security max 2
S2(config-if-range)#switchport port-security mac-address sticky
S2(config-if-range)#spanning-tree portfast
S2(config-if-range)#spanning-tree bpduguard enable

Observera att vi endast konfigurerar BPDU-guard på access-portar, och fungerar endast om vi även använder PortFast.

Root-guard

Root-guard skyddar mot switchar som felaktigt skickar ut BPDU-paket med högre Bridge-priority för att försöka ta över rollen som root-bridge. I vår topologi har vi endast tre switchar, med S1 som primary för vl1 & vl200, och S2 som primary för vl100 kan vi enkelt säga att vi aldrig vill att access-switchen ska kunna bli root för något av vlanen. Vi ställer därför in root-guard på portarna ner mot S2 i både S1 & S3.

S1(config)#spanning-tree vlan 1,200 root primary
S1(config)#spanning-tree vlan 100 root secondary
S3(config)#spanning-tree vlan 100 root primary
S3(config)#spanning-tree vlan 1,200 root secondary
S1(config)#int range fa0/1 - 2 , po1
S1(config-if-range)#spanning-tree guard root
S1(config-if-range)#
*Mar 1 03:23:32.781: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port Port-channel1.
S3(config)#int range fa0/1 - 2 , po1
S3(config-if-range)#spanning-tree guard root
S3(config-if-range)#
*Mar 1 03:24:13.205: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port Port-channel1.

UDLD

UDLD använder vi för att upptäcka unidirectional-forwarding främst vid fiberuppkopplingar, men det finns även möjlighet att konfigurera detta på vanliga ethernet-interface också.

UDLD

Så i mina ögon är aggresive-mode helt klart det bästa valet när vi konfigurerar upp UDLD, vilket vi gör enligt följande:

S1(config)#int range fa0/3 - 4 
S1(config-if-range)#udld port aggressive
S3(config)#int range fa0/3 - 4
S3(config-if-range)#udld port aggressive

Observera att vi endast lägger in det på de fysiska interfacen, det är ej möjligt att använda UDLD över en port-channel.

S1#sh udld fa0/3
Interface Fa0/3
---
Port enable administrative configuration setting: Enabled / in aggressive mode
Port enable operational state: Enabled / in aggressive mode
Current bidirectional state: Bidirectional
Current operational state: Advertisement - Single neighbor detected
Message interval: 7
Time out interval: 5
Entry 1
 ---
 Expiration time: 38
 Device ID: 1
 Current neighbor state: Bidirectional
 Device name: FDO1303Y3H8 
 Port ID: Fa0/3 
 Neighbor echo 1 device: FDO1303X3CX
 Neighbor echo 1 port: Fa0/3
Message interval: 15
 Time out interval: 5
 CDP Device name: S3

 Storm-Control

Används för att förhindra att broadcast-trafik sänker våra förbindelser i s.k. broadcast-stormar (orsakat av en loop), mer info finns att läsa här. Själva konfigurationen är rätt enkel, vi lägger in detta på våra trunk-länkar mellan S1-S2-S3.

Do not configure traffic storm control on ports that are members of an EtherChannel. Configuring traffic storm control on ports that are configured as members of an EtherChannel puts the ports into a suspended state.

Vi lägger därför in konfigen direkt på port-channeln istället.

S1(config)#int range po1 - 2
S1(config-if-range)#storm-control broadcast level ?
 <0.00 - 100.00> Enter rising threshold
 bps Enter suppression level in bits per second
 pps Enter suppression level in packets per second
S1(config-if-range)#storm-control broadcast level 60
S2(config)#inte range po1 - 2
S2(config-if-range)#storm-control bbroadcast level 60
S3(config)#int range po1 - 2
S3(config-if-range)#storm-control broadcast level 60

MDH Lab – HSRP & Securing L2

Topologi

6-1

Objectives

  • Secure the Layer 2 network against MAC flood attacks.
  • Prevent DHCP spoofing attacks.
  • Prevent unauthorized access to the network using AAA and 802.1X.

Background

A fellow network engineer that you have known and trusted for many years has invited you to lunch this week.

At lunch, he brings up the subject of network security and how two of his former co-workers had been arrested for using different Layer 2 attack techniques to gather data from other users in the office for their own personal gain in their careers and finances. The story shocks you because you have always known your friend to be very cautious with security on his network.

His story makes you realize that your business network has been cautious with external threats, Layer 3–7 security, firewalls at the borders, and so on, but insufficient at Layer 2 security and protection inside the local network. When you get back to the office, you meet with your boss to discuss your concerns.

After reviewing the company’s security policies, you begin to work on a Layer 2 security policy. First, you establish which network threats you are concerned about and then put together an action plan to mitigate these threats. While researching these threats, you learn about other potential threats to Layer 2 switches that might not be malicious but could threaten network stability.

You decide to include these threats in the policies as well. Other security measures need to be put in place to further secure the network, but you begin with configuring the switches against a few specific types of attacks, including MAC flood attacks, DHCP spoofing attacks, and unauthorized access to the local network. You plan to test the configurations in a lab environment before placing them into production.

Genomförande

Hoppar återigen över grundkonfigen för att få upp Port-channels/Trunking/VLAns, se tidigare inlägg för detta.

Vi börjar med att sätta upp HSRP mellan S1 & S3.

S1

S1(config)#int vlan 1 
S1(config-if)#ip add 172.16.1.10 255.255.255.0
S1(config-if)#standby 1 ip 172.16.1.1
S1(config-if)#standby 1 priority 100
S1(config-if)#standby 1 preempt
S1(config-if)#
S1(config-if)#int vlan 100
S1(config-if)#ip add 172.16.100.10 255.255.255.0
S1(config-if)#standby 1 ip 172.16.100.1
S1(config-if)#standby 1 priority 150
S1(config-if)#standby 1 preempt
S1(config-if)#
S1(config-if)#int vlan 200
S1(config-if)#ip add 172.16.200.10 255.255.255.0
S1(config-if)#standby 1 ip 172.16.200.1
S1(config-if)#standby 1 priority 100
S1(config-if)#standby 1 preempt
S1(config-if)#end

S3

S3(config)#int vlan 1 
S3(config-if)#ip add 172.16.1.30 255.255.255.0
S3(config-if)#standby 1 ip 172.16.1.1
S3(config-if)#standby 1 priority 150
S3(config-if)#standby 1 preempt
S3(config-if)#
S3(config-if)#int vlan 100
S3(config-if)#ip add 172.16.100.30 255.255.255.0
S3(config-if)#standby 1 ip 172.16.100.1
S3(config-if)#standby 1 priority 100
S3(config-if)#standby 1 preempt
S3(config-if)#
S3(config-if)#int vlan 200
S3(config-if)#ip add 172.16.200.30 255.255.255.0
S3(config-if)#standby 1 ip 172.16.200.1
S3(config-if)#standby 1 priority 150
S3(config-if)#standby 1 preempt
S3(config-if)#
S1#sh standby brief
 P indicates configured to preempt.
 |
Interface Grp Pri P State Active Standby Virtual IP
Vl1 1 100 P Standby 172.16.1.30 local 172.16.1.1
Vl100 1 150 P Active local 172.16.100.30 172.16.100.1
Vl200 1 100 P Standby 172.16.200.30 local 172.16.200.1

Nästa uppgift var att säkra vårat nät mot DHCP-spoofing attacker. För att lyckas med detta kan vi använda oss av “dhcp snooping“.

Då endast S2 är access-layer switch med användare inkopplade behöver vi bara konfa snooping där.

S2

S2(config)#!Aktiverar DHCP-snooping funktionen
S2(config)#ip dhcp snooping 
S2(config)#!Startar DHCP-snooping för vlan 100 & 200
S2(config)#ip dhcp snooping vlan 100,200

Alla portar räknas som per default untrusted, dvs får EJ skicka DHCPOFFERs & DHCPACKs. Vi måste därför konfigurera trusted där vi har vår DHCP-server. I detta fall har vi ingen lokalt på lanet, därför sätter vi trunk-portarna till trusted.

S2(config)#inte range fa0/1 - 4 , po1 - 2
S2(config-if-range)#ip dhcp snooping trust

Vi kan verifiera vår konfig med “sh ip dhcp snooping”.

S2#sh ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
100,200
DHCP snooping is operational on following VLANs:
100,200
DHCP snooping is configured on the following L3 Interfaces:
Insertion of option 82 is enabled
 circuit-id format: vlan-mod-port
 remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:
Int
*Mar 1 02:14:22.416: %SYS-5-CONFIG_I: Configured from console by consoleerface Trusted Rate limit (pps)
------------------------ ------- ----------------
FastEthernet0/1 yes unlimited
FastEthernet0/2 yes unlimited
FastEthernet0/3 yes unlimited
FastEthernet0/4 yes unlimited
Port-channel1 yes unlimited
Port-channel2 yes unlimited

MAC-flood attacker blir bara lite repetition från CCNA, genom att begränsa antal mac-adresser en port kan lära sig behöver vi inte vara rädda för att råka ut för cam-table overflow. Även här behöver vi endast konfa S2 då det är den enda switchen i access-layer.

S2(config)#int range fa0/6 - 20 
S2(config-if-range)#switchport mode access
S2(config-if-range)#switchport access vlan 100
S2(config-if-range)#switchport port-security
S2(config-if-range)#switchport port-security max 2
S2(config-if-range)#switchport port-security mac-address sticky
S2(config-if-range)#spanning-tree portfast
S2(config-if-range)#spanning-tree bpduguard enable

Detta gör att switchen endast kan lära sig max 2st mac-adresser per interface (2×15 =  30 mac-adresser).

För att begränsa access till nätet är ett alternativ att använda oss av 802.1x, vilket kräver att användarna autentiserar sig innan porten slår över till forwarding. Mer info om dot1x finns att läsa här.

S2(config)#aaa new-model
S2(config)#!Autentiserar anvandare mot anvandardatabasen som ligger lokalt pa switchen
S2(config)#aaa authentication dot1x default local
S2(config)#!aktiverar dot1x
S2(config)#dot1x system-auth-control
S2(config)#!skapar anvndare
S2(config)#username admin1 password cisco
S2(config)#username user1 password cisco
S2(config)#username user2 password cisco
S2(config)#inte range fa0/6 - 20
S2(config-if-range)#!aktiverar dot1x-autentisering pa interfacen
S2(config-if-range)#dot1x port-control auto
S2(config-if-range)#
*Mar 1 02:28:23.114: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to down
*Mar 1 02:28:23.131: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/18, changed state to down

Observera att både Fa0/11 & Fa0/18 genast gick ner efter vi la in konfigen, detta pga användarna ej är autentiserade ännu.

S2#sh dot1x interface fa0/11
Dot1x Info for FastEthernet0/11
-----------------------------------
PAE = AUTHENTICATOR
PortControl = AUTO
ControlDirection = Both 
HostMode = SINGLE_HOST
Violation Mode = PROTECT
ReAuthentication = Disabled
QuietPeriod = 60
ServerTimeout = 30
SuppTimeout = 30
ReAuthPeriod = 3600 (Locally configured)
ReAuthMax = 2
MaxReq = 2
TxPeriod = 30
RateLimitPeriod = 0

Rekommenderat är dock att koppla autentiseringen mot en extern RADIUS-server istället.

MDH Lab – IP SLA ICMP & Jitter

Topologi

lab-ipsla

Objectives

  • Configure trunking, VTP, and SVIs.
  • Implement IP SLAs to monitor various network performance characteristics.

Background

Cisco IOS IP service level agreements (SLAs) allow users to monitor network performance between Cisco devices (switches or routers) or from a Cisco device to a remote IP device.

Cisco IOS IP SLAs can be applied to VoIP and video applications as well as monitoring end-to-end IP network performance.In this lab, you configure trunking, VTP, and SVIs. You configure IP SLA monitors to test ICMP echo network  and jitter performance between S1 and each switch.

Genomförande

Hoppar över grundkonfigen för Etherchannels/Vlan/VTP/Trunkar så all L2-konfig är redan klart. Se tidigare inlägg om detta skulle vara intressant..

Vi börjar med att konfa upp L3 för samtliga switchar.

S1

S1(config)#int vlan 1
 S1(config-if)#ip add 172.16.1.1 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#int vlan 100
 S1(config-if)#ip add 172.16.100.1 255.255.255.0
 S1(config-if)#int vlan 200
 S1(config-if)#ip add 172.16.200.1 255.255.255.0
 S1(config-if)#exit
 S1(config)#ip routing

S2

S2(config)#inte vlan 1
 S2(config-if)#ip add 172.16.1.102 255.255.255.0
 S2(config-if)#no shut

S3

S3(config)#inte vlan 1
 S3(config-if)#ip add 172.16.1.103 255.255.255.0
 S3(config-if)#no shut

Då återstår det endast att sätta upp IP SLA. Enligt labben ska vi konfigurera upp ICMP-Echo & Jitter på S1 mot både S2 & S3.

För att kunna testa just jitter behöver vi konfigurera IP SLA-responders på S2 & S3, detta behövs dock inte om vi endast vill använda ICMP.

S2 & S3

S2(config)#ip sla responder
 S2(config)#ip sla responder udp-echo ipaddress 172.16.1.1 port 2525
S3(config)#ip sla responder
 S3(config)#ip sla responder udp-echo ipaddress 172.16.1.1 port 2525

Vi konfar sedan upp SLA-mätningen på S1. Vi behöver en SLA-instans per mätnings-funktion, då vi vill testa både ICMP & Jitter behövs därför två mot S2 och två mot S3.

S1

S1(config)#ip sla 20
 S1(config-ip-sla-echo)#icmp-echo 172.16.1.102
 S1(config-ip-sla-echo)#frequency 5
 S1(config-ip-sla-echo)#timeout 1000
 S1(config-ip-sla-echo)#exit
 S1(config)#
S1(config)#ip sla 25
 S1(config-ip-sla)#udp-jitter 172.16.1.102 2525
 S1(config-ip-sla-jitter)#frequency 20
 S1(config-ip-sla-jitter)#precision milliseconds
 S1(config-ip-sla-jitter)#timeout 1000
 S1(config-ip-sla-jitter)#exit
 S1(config)#
S1(config)#ip sla 30
 S1(config-ip-sla)#icmp-echo 172.16.1.103
 S1(config-ip-sla-echo)#frequency 5
 S1(config-ip-sla-echo)#timeout 1000
 S1(config-ip-sla-echo)#exit
 S1(config)#
S1(config)#ip sla 35
 S1(config-ip-sla)#udp-jitter 172.16.1.103 2525
 S1(config-ip-sla-jitter)#frequency 20
 S1(config-ip-sla-jitter)#precision milliseconds
 S1(config-ip-sla-jitter)#timeout 1000
 S1(config-ip-sla-jitter)#exit
 S1(config)#end

Vi behöver sedan bara schemalägga och starta våra IP SLA-mätningar.

S1(config)#ip sla schedule 20 life forever start-time now
S1(config)#ip sla schedule 25 life forever start-time now
S1(config)#ip sla schedule 30 life forever start-time now
S1(config)#ip sla schedule 35 life forever start-time now

Vi kan verifiera vår IP-SLA konfig med “sh ip sla configuration”.

S1#sh ip sla configuration 25
IP SLAs, Infrastructure Engine-II.
Entry number: 25
Owner: 
Tag: 
Type of operation to perform: udp-jitter
Target address/Source address: 172.16.1.102/0.0.0.0
Target port/Source port: 2525/0
Type Of Service parameter: 0x0
Request size (ARR data portion): 32
Operation timeout (milliseconds): 1000
Packet Interval (milliseconds)/Number of packets: 20/10
Verify data: No
Vrf Name: 
Control Packets: enabled
Schedule:
 Operation frequency (seconds): 20
 Next Scheduled Start Time: Start Time already passed
 Group Scheduled : FALSE
 Randomly Scheduled : FALSE
 Life (seconds): Forever
 Entry Ageout (seconds): never
 Recurring (Starting Everyday): FALSE
 Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
 Number of statistic hours kept: 2
 Number of statistic distribution buckets kept: 1
 Statistic distribution interval (milliseconds): 20
Enhanced History:

Det går även att verifiera på S2 & S3 så att de verkligen tar emot förfrågningar från S1.

S2#sh ip sla responder
IP SLAs Responder is: Enabled
Number of control message received: 8 Number of errors: 0 
Recent sources:
 172.16.1.1 [01:13:22.643 UTC Mon Mar 1 1993]
 172.16.1.1 [01:13:02.644 UTC Mon Mar 1 1993]
 172.16.1.1 [01:12:42.638 UTC Mon Mar 1 1993]
 172.16.1.1 [01:12:22.639 UTC Mon Mar 1 1993]
 172.16.1.1 [01:12:02.641 UTC Mon Mar 1 1993]
Recent error sources:
udpEcho Responder: 
 IP Address Port
 172.16.1.1 2525

För att se resultatet av våra mätningar, använd “show ip sla statistics”.

S1#sh ip sla statistics
Round Trip Time (RTT) for Index 20
 Latest RTT: 8 ms
Latest operation start time: *01:14:11.767 UTC Mon Mar 1 1993
Latest operation return code: OK
Number of successes: 40
Number of failures: 1
Operation time to live: Forever

Round Trip Time (RTT) for Index 25
 Latest RTT: 2 ms
Latest operation start time: *01:13:55.904 UTC Mon Mar 1 1993
Latest operation return code: OK
RTT Values
 Number Of RTT: 10
 RTT Min/Avg/Max: 2/2/4 ms
Latency one-way time milliseconds
 Number of Latency one-way Samples: 0
 Source to Destination Latency one way Min/Avg/Max: 0/0/0 ms
 Destination to Source Latency one way Min/Avg/Max: 0/0/0 ms
Jitter time milliseconds
 Number of SD Jitter Samples: 9
 Number of DS Jitter Samples: 9
 Source to Destination Jitter Min/Avg/Max: 0/1/2 ms
 Destination to Source Jitter Min/Avg/Max: 0/1/1 ms
Packet Loss Values
 Loss Source to Destination: 0 Loss Destination to Source: 0
 Out Of Sequence: 0 Tail Drop: 0 Packet Late Arrival: 0
Voice Score Values
 Calculated Planning Impairment Factor (ICPIF): 0
 Mean Opinion Score (MOS): 0
Number of successes: 11
Number of failures: 0
Operation time to live: Forever

Round Trip Time (RTT) for Index 30
 Latest RTT: 1 ms
Latest operation start time: *01:14:15.038 UTC Mon Mar 1 1993
Latest operation return code: OK
Number of successes: 40
Number of failures: 0
Operation time to live: Forever

Round Trip Time (RTT) for Index 35
 Latest RTT: 2 ms
Latest operation start time: *01:14:04.217 UTC Mon Mar 1 1993
Latest operation return code: OK
RTT Values
 Number Of RTT: 10
 RTT Min/Avg/Max: 1/2/3 ms
Latency one-way time milliseconds
 Number of Latency one-way Samples: 0
 Source to Destination Latency one way Min/Avg/Max: 0/0/0 ms
 Destination to Source Latency one way Min/Avg/Max: 0/0/0 ms
Jitter time milliseconds
 Number of SD Jitter Samples: 9
 Number of DS Jitter Samples: 9
 Source to Destination Jitter Min/Avg/Max: 0/1/1 ms
 Destination to Source Jitter Min/Avg/Max: 0/1/2 ms
Packet Loss Values
 Loss Source to Destination: 0 Loss Destination to Source: 0
 Out Of Sequence: 0 Tail Drop: 0 Packet Late Arrival: 0
Voice Score Values
 Calculated Planning Impairment Factor (ICPIF): 0
 Mean Opinion Score (MOS): 0
Number of successes: 10
Number of failures: 0
Operation time to live: Forever

IP SLA går dock att använda till så mycket mer än att bara köra lite jitter/udp-test sen, exempelvis PBR/HSRP-tracking etc, vilket jag kommer ta upp i senare inlägg. 🙂

MDH Lab – HSRP

Topologi

lab5-2

Objective

Configure inter-VLAN routing with HSRP to provide redundant, fault-tolerant routing to the internal network.

Background

Hot Standby Router Protocol (HSRP) is a Cisco-proprietary redundancy protocol for establishing a faulttolerant default gateway. It is described in RFC 2281. HSRP provides a transparent failover mechanism to the end stations on the network. This provides users at the access layer with uninterrupted service to the network if the primary gateway becomes inaccessible.

The Virtual Router Redundancy Protocol (VRRP) is a standards-based alternative to HSRP and is defined in RFC 3768. The two technologies are similar but not compatible. This lab focuses on HSRP.

Genomförande

Börjar med default-konfig för att få upp vlan/etherchannels/trunkar.

S1

Switch(config)#hostname S1
 S1(config)#line con 0
 S1(config-line)#logging sync
 S1(config-line)#!Trunk-links till S2
 S1(config-line)#int range fa0/1 - 2
 S1(config-if-range)#switchport trunk encaps dot1q
 S1(config-if-range)#switchport mode trunk
 S1(config-if-range)#description to S2
 S1(config-if-range)#channel-protocol lacp
 S1(config-if-range)#channel-group 1 mode active
 Creating a port-channel interface Port-channel 1
S1(config-if-range)#
 S1(config-if-range)#!Trunk-links till S3
 S1(config-if-range)#int range fa0/3 - 4
 S1(config-if-range)#switchport trunk encaps dot1q
 S1(config-if-range)#switchport mode trunk
 S1(config-if-range)#description to S2
 S1(config-if-range)#channel-protocol lacp
 S1(config-if-range)#channel-group 2 mode active
 Creating a port-channel interface Port-channel 2
S1(config-if-range)#exit
 S1(config)#
 S1(config)#vtp mode server
 Device mode already VTP SERVER.
 S1(config)#vtp domain CISCO
 Changing VTP domain name from NULL to CISCO
 S1(config)#
 S1(config)#vlan 10
 S1(config-vlan)#name Red
 S1(config-vlan)#vlan 20
 S1(config-vlan)#name Blue
 S1(config-vlan)#vlan 30
 S1(config-vlan)#name Orange
 S1(config-vlan)#vlan 40
 S1(config-vlan)#

S3

Switch(config)#hostname S3
 S3(config)#line con 0
 S3(config-line)#logging sync
 S3(config-line)#!Trunk-links till S2
 S3(config-line)#int range fa0/1 - 2
 S3(config-if-range)#switchport trunk encaps dot1q
 S3(config-if-range)#switchport mode trunk
 S3(config-if-range)#description to S2
 S3(config-if-range)#channel-protocol lacp
 S3(config-if-range)#channel-group 1 mode active
 Creating a port-channel interface Port-channel 1
S3(config-if-range)#
 S3(config-if-range)#!Trunk-links till S1
 S3(config-if-range)#int range fa0/3 - 4
 S3(config-if-range)#switchport trunk encaps dot1q
 S3(config-if-range)#switchport mode trunk
 S3(config-if-range)#description to S1
 S3(config-if-range)#channel-protocol lacp
 S3(config-if-range)#channel-group 2 mode passive
 Creating a port-channel interface Port-channel 2
S3(config-if-range)#exit
 S3(config)#
 S3(config)#vtp mode client
 Setting device to VTP CLIENT mode.
 S3(config)#vtp domain CISCO

S2

Switch(config)#hostname S2
 S2(config)#line con 0
 S2(config-line)#logging sync
 S2(config-line)#!Trunk-links till S1
 S2(config-line)#int range fa0/1 - 2
 S2(config-if-range)#switchport mode trunk
 S2(config-if-range)#description to S1
 S2(config-if-range)#channel-protocol lacp
 S2(config-if-range)#channel-group 1 mode passive
 Creating a port-channel interface Port-channel 1
S2(config-if-range)#
 S2(config-if-range)#!Trunk-links till S3
 S2(config-if-range)#int range fa0/3 - 4
 S2(config-if-range)#switchport mode trunk
 S2(config-if-range)#description to S3
 S2(config-if-range)#channel-protocol lacp
 S2(config-if-range)#channel-group 2 mode passive
 Creating a port-channel interface Port-channel 2
S2(config-if-range)#exit
 S2(config)#
 S2(config)#vtp mode client
 Setting device to VTP CLIENT mode.
 S2(config)#vtp domain CISCO
 Domain name already set to CISCO.

Då återstår det bara att sätta upp HSRP mellan S1 & S3. Enligt labben ska fördelningen vara enligt följande:

  • S1 Primary – Vl1, 20 & 40
  • S3 Primary – Vl10 & 30

Vi styr detta genom att modfiera priority-värdet för den switch vi vill ska vara active (default = 100, högst värde vinner).

S1

S1(config)#interface vlan 1
 S1(config-if)#ip add 172.16.1.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.1.1
 S1(config-if)#standby 1 priority 150
 S1(config-if)#standby 1 preempt
 S1(config-if)#
 S1(config-if)#interface vlan 10
 S1(config-if)#ip add 172.16.10.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.10.1
 S1(config-if)#standby 1 priority 100
 S1(config-if)#standby 1 preempt
 S1(config-if)#
 S1(config-if)#interface vlan 20
 S1(config-if)#ip add 172.16.20.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.20.1
 S1(config-if)#standby 1 priority 150
 S1(config-if)#standby 1 preempt
 S1(config-if)#
 S1(config-if)#interface vlan 30
 S1(config-if)#ip add 172.16.30.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.30.1
 S1(config-if)#standby 1 priority 100
 S1(config-if)#standby 1 preempt
 S1(config-if)#
 S1(config-if)#interface vlan 40
 S1(config-if)#ip add 172.16.40.10 255.255.255.0
 S1(config-if)#no shut
 S1(config-if)#standby 1 ip 172.16.40.1
 S1(config-if)#standby 1 priority 150
 S1(config-if)#standby 1 preempt
 S1(config-if)#exit
 S1(config)#ip routing

S3

S3(config)#interface vlan 1
 S3(config-if)#ip add 172.16.1.30 255.255.255.0
 S3(config-if)#no shut
 S3(config-if)#standby 1 ip 172.16.1.1
 S3(config-if)#standby 1 priority 100
 S3(config-if)#standby 1 preempt
 S3(config-if)#
 S3(config-if)#interface vlan 10
 S3(config-if)#ip add 172.16.10.30 255.255.255.0
 S3(config-if)#no shut
 S3(config-if)#standby 1 ip 172.16.10.1
 S3(config-if)#standby 1 priority 150
 S3(config-if)#standby 1 preempt
 S3(config-if)#
 S3(config-if)#interface vlan 20
 S3(config-if)#ip add 172.16.20.30 255.255.255.0
 S3(config-if)#no shut
 S3(config-if)#standby 1 ip 172.16.20.1
 S3(config-if)#standby 1 priority 100
 S3(config-if)#standby 1 preempt
 S3(config-if)#
 S3(config-if)#interface vlan 30
 S3(config-if)#ip add 172.16.30.30 255.255.255.0
 S3(config-if)#no shut
 S3(config-if)#standby 1 ip 172.16.30.1
 S3(config-if)#standby 1 priority 150
 S3(config-if)#standby 1 preempt
 S3(config-if)#
 S3(config-if)#interface vlan 40
 S3(config-if)#ip add 172.16.40.30 255.255.255.0
 S3(config-if)#no shut
 S3(config-if)#standby 1 ip 172.16.40.1
 S3(config-if)#standby 1 priority 100
 S3(config-if)#standby 1 preempt
 S3(config-if)#exit
 S3(config)#ip routing
 S3(config)#

S2

S2(config)#interface vlan 1
 S2(config-if)#ip add 172.16.1.2 255.255.255.0
 S2(config-if)#no shut
 S2(config-if)#exit
 S2(config)#
 S2(config)#ip default-gateway 172.16.1.1

Verifiering

S3#sh standby
Vlan1 - Group 1
 State is Standby
 Virtual IP address is 172.16.1.1
 Active virtual MAC address is 0000.0c07.ac01
 Local virtual MAC address is 0000.0c07.ac01 (v1 default)
 Hello time 3 sec, hold time 10 sec
 Next hello sent in 1.216 secs
 Preemption enabled
 Active router is 172.16.1.10, priority 150 (expires in 9.600 sec)
 Standby router is local
 Priority 100 (default 100)
 Group name is "hsrp-Vl1-1" (default)
Vlan10 - Group 1
 State is Active
 Virtual IP address is 172.16.10.1
 Active virtual MAC address is 0000.0c07.ac01
 Local virtual MAC address is 0000.0c07.ac01 (v1 default)
 Hello time 3 sec, hold time 10 sec
 Next hello sent in 0.208 secs
 Preemption enabled
 Active router is local
 Standby router is 172.16.10.10, priority 100 (expires in 10.112 sec)
 Priority 150 (configured 150)
 Group name is "hsrp-Vl10-1" (default)
Vlan20 - Group 1
 State is Standby
 Virtual IP address is 172.16.20.1
 Active virtual MAC address is 0000.0c07.ac01
 Local virtual MAC address is 0000.0c07.ac01 (v1 default)
 Hello time 3 sec, hold time 10 sec
 Next hello sent in 0.560 secs
 Preemption enabled
 Active router is 172.16.20.10, priority 150 (expires in 8.080 sec)
 Standby router is local
 Priority 100 (default 100)
 Group name is "hsrp-Vl20-1" (default)
Vlan30 - Group 1
 State is Active
 Virtual IP address is 172.16.30.1
 Active virtual MAC address is 0000.0c07.ac01
 Local virtual MAC address is 0000.0c07.ac01 (v1 default)
 Hello time 3 sec, hold time 10 sec
 Next hello sent in 1.824 secs
 Preemption enabled
 Active router is local
 Standby router is 172.16.30.10, priority 100 (expires in 10.496 sec)
 Priority 150 (configured 150)
 Group name is "hsrp-Vl30-1" (default)
Vlan40 - Group 1
 State is Standby
 Virtual IP address is 172.16.40.1
 Active virtual MAC address is 0000.0c07.ac01
 Local virtual MAC address is 0000.0c07.ac01 (v1 default)
 Hello time 3 sec, hold time 10 sec
 Next hello sent in 1.040 secs
 Preemption enabled
 Active router is 172.16.40.10, priority 150 (expires in 10.608 sec)
 Standby router is local
 Priority 100 (default 100)
 Group name is "hsrp-Vl40-1" (default)
S2#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/203/1007 ms

Allt ok så långt. Vi kan även testa failover:

S1(config)#inte range fa0/1 - 4
S1(config-if-range)#shut

En debug visar då följande på S3:

S3#
*Mar 1 00:19:36.980: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to down
*Mar 1 00:19:36.988: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to down
*Mar 1 00:19:36.997: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel2, changed state to down
S3#
*Mar 1 00:19:37.978: %LINK-3-UPDOWN: Interface FastEthernet0/3, changed state to down
*Mar 1 00:19:38.012: %LINK-3-UPDOWN: Interface Port-channel2, changed state to down
*Mar 1 00:19:38.012: %LINK-3-UPDOWN: Interface FastEthernet0/4, changed state to down
S3#
*Mar 1 00:19:45.452: HSRP: Vl30 Grp 1 Standby router is unknown, was 172.16.30.10
*Mar 1 00:19:45.452: HSRP: Vl30 Nbr 172.16.30.10 no longer standby for group 1 (Active)
*Mar 1 00:19:45.452: HSRP: Vl30 Nbr 172.16.30.10 Was active or standby - start passive holddown
*Mar 1 00:19:45.872: HSRP: Vl10 Grp 1 Standby router is unknown, was 172.16.10.10
*Mar 1 00:19:45.872: HSRP: Vl10 Nbr 172.16.10.10 no longer standby for group 1 (Active)
*Mar 1 00:19:45.872: HSRP: Vl10 Nbr 172.16.10.10 Was active or
S3# standby - start passive holddown
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Standby: c/Active timer expired (172.16.1.10)
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Active router is local, was 172.16.1.10
*Mar 1 00:19:45.872: HSRP: Vl1 Nbr 172.16.1.10 no longer active for group 1 (Standby)
*Mar 1 00:19:45.872: HSRP: Vl1 Nbr 172.16.1.10 Was active or standby - start passive holddown
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Standby router is unknown, was local
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Standby -> Act
S3#ive
*Mar 1 00:19:45.872: %HSRP-5-STATECHANGE: Vlan1 Grp 1 state Standby -> Active
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Redundancy "hsrp-Vl1-1" state Standby -> Active
*Mar 1 00:19:45.872: HSRP: Vl1 Added 172.16.1.1 to ARP (0000.0c07.ac01)
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Activating MAC 0000.0c07.ac01
*Mar 1 00:19:45.872: HSRP: Vl1 Grp 1 Adding 0000.0c07.ac01 to MAC address filter
*Mar 1 00:19:45.872: HSRP: Vl1 IP Redundancy "hsrp-Vl1-1" standby, local -> unknown
*Mar 1 00:19:45.872: HSRP:
S3# Vl1 IP Redundancy "hsrp-Vl1-1" update, Standby -> Active
*Mar 1 00:19:46.023: HSRP: Vl20 Grp 1 Standby: c/Active timer expired (172.16.20.10)
*Mar 1 00:19:46.023: HSRP: Vl20 Grp 1 Active router is local, was 172.16.20.10
*Mar 1 00:19:46.023: HSRP: Vl20 Nbr 172.16.20.10 no longer active for group 1 (Standby)
*Mar 1 00:19:46.023: HSRP: Vl20 Nbr 172.16.20.10 Was active or standby - start passive holddown
*Mar 1 00:19:46.023: HSRP: Vl20 Grp 1 Standby router is unknown, was local
*Mar 1 00:19:46.02
S3#3: HSRP: Vl20 Grp 1 Standby -> Active
*Mar 1 00:19:46.023: %HSRP-5-STATECHANGE: Vlan20 Grp 1 state Standby -> Active
*Mar 1 00:19:46.023: HSRP: Vl20 Grp 1 Redundancy "hsrp-Vl20-1" state Standby -> Active
*Mar 1 00:19:46.023: HSRP: Vl20 Added 172.16.20.1 to ARP (0000.0c07.ac01)
*Mar 1 00:19:46.023: HSRP: Vl20 Grp 1 Activating MAC 0000.0c07.ac01
*Mar 1 00:19:46.023: HSRP: Vl20 Grp 1 Adding 0000.0c07.ac01 to MAC address filter
*Mar 1 00:19:46.023: HSRP: Vl20 IP Redundancy "hsrp-Vl20-1" standby, lo
S3#cal -> unknown
*Mar 1 00:19:46.023: HSRP: Vl20 IP Redundancy "hsrp-Vl20-1" update, Standby -> Active
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Standby: c/Active timer expired (172.16.40.10)
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Active router is local, was 172.16.40.10
*Mar 1 00:19:46.392: HSRP: Vl40 Nbr 172.16.40.10 no longer active for group 1 (Standby)
*Mar 1 00:19:46.392: HSRP: Vl40 Nbr 172.16.40.10 Was active or standby - start passive holddown
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Standby rout
S3#er is unknown, was local
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Standby -> Active
*Mar 1 00:19:46.392: %HSRP-5-STATECHANGE: Vlan40 Grp 1 state Standby -> Active
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Redundancy "hsrp-Vl40-1" state Standby -> Active
*Mar 1 00:19:46.392: HSRP: Vl40 Added 172.16.40.1 to ARP (0000.0c07.ac01)
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Activating MAC 0000.0c07.ac01
*Mar 1 00:19:46.392: HSRP: Vl40 Grp 1 Adding 0000.0c07.ac01 to MAC address filter
*Mar 1 00:19:46.392: HSRP:
S3# Vl40 IP Redundancy "hsrp-Vl40-1" standby, local -> unknown
*Mar 1 00:19:46.392: HSRP: Vl40 IP Redundancy "hsrp-Vl40-1" update, Standby -> Active
*Mar 1 00:19:48.875: HSRP: Vl1 IP Redundancy "hsrp-Vl1-1" update, Active -> Active
*Mar 1 00:19:49.043: HSRP: Vl20 IP Redundancy "hsrp-Vl20-1" update, Active -> Active
*Mar 1 00:19:49.412: HSRP: Vl40 IP Redundancy "hsrp-Vl40-1" update, Active -> Active

Pingar vi från S2 igen kan vi nu se att S3 har tagit över:

S2#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/9 ms

Tar vi upp interfacen på S1 så går den återigen Active för Vl1, 20 & 40 pga “standby 1 preempt”.,

S1#sh standby brief
 P indicates configured to preempt.
 |
Interface Grp Pri P State Active Standby Virtual IP
Vl1 1 150 P Active local 172.16.1.30 172.16.1.1
Vl10 1 100 P Standby 172.16.10.30 local 172.16.10.1
Vl20 1 150 P Active local 172.16.20.30 172.16.20.1
Vl30 1 100 P Standby 172.16.30.30 local 172.16.30.1
Vl40 1 150 P Active local 172.16.40.30 172.16.40.1

Klart!

MDH Lab – Switch Case Study

Topologi

lab4-3clean

Objectives

  • Plan and design the International Travel Agency switched network as shown in the diagram and described below.
  • Implement the design on the switches and router.
  • Verify that all configurations are operational and functioning according to the requirements.

Requirements

You will configure a group of switches and a router for the International Travel Agency. The network includes two distribution switches, S1 and S3, and two one access layer switches, S2. External router R3 and S1 provide inter-VLAN routing. Design the addressing scheme using the address space 172.16.0.0/16 range. You can subnet it any way you want, although it is recommended to use /24 subnets for simplicity.

  1. Place all switches in the VTP domain CISCO. Make S1 the VTP server and all other switches VTP clients.
  2. On S1, create the VLANs shown in the VLAN table and assign the names given. For subnet planning, allocate a subnet for each VLAN.
  3. Configure S1 as the primary spanning-tree root bridge for all VLANs. Configure S3 as the backup root bridge for all VLANs.
  4. Configure Fa0/4 between S1 and S3 as a Layer 3 link and assign a subnet to it.
  5. Create a loopback interface on S1 and assign a subnet to it.
  6. Configure the Fa0/3 link between S1 and S3 as an ISL trunk.
  7. Statically configure all inter-switch links as trunks.
  8. Configure all other trunk links using 802.1Q.
  9. Bind together the links from S1 & S3 to the access-switch together in an EtherChannel.
  10. Enable PortFast on all access ports.
  11. On S2, place Fa0/15 through Fa0/17 in VLAN 10. Place Fa0/19 and Fa0/25 in VLAN 20. Place Fa0/21-22 in VLAN 30.
  12. Create an 802.1Q trunk link between R3 and S3. Only VLANs 10 and 40 to pass through the trunk.
  13. Configure R2 subinterfaces for VLANs 10 and 40.
  14. Create an SVI on S1 in VLANs 20, 30, and 40. Create an SVI on S3 in VLAN 10 and 30, an SVI on S2 in VLAN 40.
  15.  Enable IP routing on S1 and S3. On R2 and S1, configure EIGRP for the whole major network (172.16.0.0/16) and disable automatic summarization.

VLANs:

  • Vlan 10 – Red
  • Vlan 20 – Blue
  • Vlan 30 – Orange
  • Vlan 40 – Green

Genomförande

Subnetting

Jag har som synes redan lagt in den subnetting jag gjorde i topologin men såhär ser den ut iaf: 172.16.0.0/16

Vlan 10 - Red 172.16.10.0/24
 Vlan 20 - Blue 172.16.20.0/24
 Vlan 30 - Orange 172.16.30.0/24
 Vlan 40 - Green 172.16.40.0/24

S1

Lo0 - 172.16.1.1/24
Vlan 20 - 172.16.20.1/24
Vlan 30 - 172.16.30.1/24
Vlan 40 - 172.16.40.1/24
S1-S3 Link - 172.16.13.1/24

S3

Vlan 10 - 172.16.10.3/24
S1-S3 Link - 172.16.13.3/24

S2

Vlan 40 - 172.16.40.2/24

R3

Vlan 40 - 172.16.40.200/24
Vlan 10 - 172.16.10.200/24

Med den information vi fått ovan kan vi uppdatera vår topologi lite:

Basic L2-konfig

S1 – Kom ihåg att S1 även ska vara Root-bridge för samtliga VLAN & VTP-server

Switch(config)#hostname S1
 S1(config)#line con 0
 S1(config-line)#logging sync
 S1(config-line)#!Trunk-links till S2
 S1(config-line)#int range fa0/1 - 2
 S1(config-if-range)#switchport trunk encaps dot1q
 S1(config-if-range)#switchport mode trunk
 S1(config-if-range)#description to S2
 S1(config-if-range)#channel-protocol lacp
 S1(config-if-range)#channel-group 1 mode active
 Creating a port-channel interface Port-channel 1
S1(config-if-range)#!L3-link till S3
 S1(config-if-range)#inte fa0/4
 % Command exited out of interface range and its sub-modes.
 Not executing the command for second and later interfaces
 S1(config-if)#no switchport
 S1(config-if)#ip add 172.16.13.1 255.255.255.0
 S1(config-if)#description to S3 L3-port
 S1(config-if)#!ISL-trunk till S3
 S1(config-if)#int fa0/3
 S1(config-if)#switchport trunk encapsulation isl
 S1(config-if)#switchport mode trunk
 S1(config-if)#description Trunklink to S3
 S1(config-if)#!VTP
 S1(config-if)#exit
 S1(config)#vtp mode server
 Device mode already VTP SERVER.
 S1(config)#vtp domain CISCO
 Changing VTP domain name from NULL to CISCO
 S1(config)#
 *Mar 1 00:14:20.226: %SW_VLAN-6-VTP_DOMAIN_NAME_CHG: VTP domain name changed to CISCO.
 S1(config)#!VLANs
 S1(config)#vlan 10
 S1(config-vlan)#name Red
 S1(config-vlan)#vlan 20
 S1(config-vlan)#name Blue
 S1(config-vlan)#vlan 30
 S1(config-vlan)#name Orange
 S1(config-vlan)#vlan 40
 S1(config-vlan)#name Green
 S1(config-vlan)#exit
 S1(config)#spanning-tree vlan 1,10,20,30,40 root primary

S3 – Ska även vara Secondary Root-bridge för samtliga vlan

Switch(config)#hostname S3
 S3(config)#line con 0
 S3(config-line)#logging sync
 S3(config-line)#!Trunk-links till S2
 S3(config-line)#int range fa0/1 - 2
 S3(config-if-range)#switchport trunk encaps dot1q
 S3(config-if-range)#switchport mode trunk
 S3(config-if-range)#channel-protocol lacp
 S3(config-if-range)#channel-group 1 mode active
 Creating a port-channel interface Port-channel 1
S3(config-if-range)#
 S3(config-if-range)#description to S2
 S3(config-if-range)#inte fa0/3
 % Command exited out of interface range and its sub-modes.
 Not executing the command for second and later interfaces
 S3(config-if)#!ISL-trunk till S1
 S3(config-if)#switchport trunk encaps ISL
 S3(config-if)#switchport mode trunk
 S3(config-if)#description ISL-trunk to S1
 S3(config-if)#!L3-port till S1
 S3(config-if)#int fa0/4
 S3(config-if)#no switchport
 S3(config-if)#ip add 172.16.13.3 255.255.255.0
 S3(config-if)#description L3-link to S1
 S3(config-if)#exit
 S3(config)#vtp mode client
 Setting device to VTP CLIENT mode.
 S3(config)#vtp domain CISCO
 Domain name already set to CISCO.
 S3(config)#spanning-tree vlan 1,10,20,30,40 root secondary

S2

Switch(config)#hostname S2
 S2(config)#line con 0
 S2(config-line)#logging sync
 S2(config-line)#!Etherchannels till S1 & S3
 S2(config-line)#inte range fa0/1 - 2
 S2(config-if-range)#switchport mode trunk
 S2(config-if-range)#description to S1
 S2(config-if-range)#channel-protocol lacp
 S2(config-if-range)#channel-group 1 mode passive
 Creating a port-channel interface Port-channel 1
S2(config-if-range)#int range fa0/3 - 4
 S2(config-if-range)#switchport mode trunk
 S2(config-if-range)#description to S3
 S2(config-if-range)#channel-protocol lacp
 S2(config-if-range)#channel-group 2 mode passive
 Creating a port-channel interface Port-channel 2
S2(config-if-range)#exit
 S2(config)#!VTP
 S2(config)#vtp mode client
 Setting device to VTP CLIENT mode.
 S2(config)#vtp domain CISCO
 Domain name already set to CISCO.
S2(config)#!Host-interface
 S2(config)#int range fa0/15 - 17
 S2(config-if-range)#switchport mode access
 S2(config-if-range)#switchport access vlan 10
 S2(config-if-range)#spanning-tree portfast
 S2(config-if-range)#int range fa0/19 - 20
 S2(config-if-range)#switchport mode access
 S2(config-if-range)#switchport access vlan 20
 S2(config-if-range)#spanning-tree portfast
 S2(config-if-range)#int range fa0/21-22
 S2(config-if-range)#switchport mode access
 S2(config-if-range)#switchport access vlan 30
 S2(config-if-range)#spanning-tree portfast
 S2(config-if-range)end

L3-Konfig

S1 – Kom ihåg att aktivera routing innan vi lägger in EIGRP-konfig

S1(config)#int lo0
 S1(config-if)#ip add 172.16.1.1 255.255.255.0
 S1(config-if)#!SVIs for VLANs
 S1(config-if)#int vlan 20
 S1(config-if)#ip add 172.16.20.1 255.255.255.0
 S1(config-if)#description Red
 S1(config-if)#int vlan 30
 S1(config-if)#ip add 172.16.30.1 255.255.255.0
 S1(config-if)#description Blue
 S1(config-if)#int vlan 40
 S1(config-if)#ip add 172.16.40.1 255.255.255.0
 S1(config-if)#description Green
 S1(config-if)#exit
 S1(config)#ip routing
 S1(config)#router eigrp 1
 S1(config-router)#network 172.16.0.0
 S1(config-router)#no auto
 S1(config-router)#no auto-summary

S3

S3(config)#int vlan 10
 S3(config-if)#ip add 172.16.10.3 255.255.255.0
 S3(config-if)#description Red
 S3(config-if)#int vlan 30
 S3(config-if)#ip add 172.16.30.3 255.255.255.0
 S3(config-if)#description Orange
 S3(config-if)#exit
 S3(config)#ip routing
S3(config-if)#!trunk to R3
S3(config-if)#int fa0/5
S3(config-if)#description trunk to R3
S3(config-if)#switchport mode trunk
S3(config-if)#switchport trunk allowed vlan 10,40

S2

S2(config)#int vlan 40 
S2(config-if)#ip add 172.16.40.2 255.255.255.0 
S2(config-if)#description Green

Då var all switch-konfig klar, endast routern kvar.. R3

Router(config)#hostname R3
 R3(config)#inte fa0/1
 R3(config-if)#description to S3-trunklink
 R3(config-if)#no shut
 R3(config-if)#inte fa0/1.10
 R3(config-subif)#encapsulation dot1q 10
 R3(config-subif)#ip add 172.16.10.200 255.255.255.0
 R3(config-subif)#inte fa0/1.40
 R3(config-subif)#encapsulation dot1q 40
 R3(config-subif)#ip add 172.16.40.200 255.255.255.0
 R3(config-subif)#exit
R3(config)#router eigrp 1
 R3(config-router)#network 172.16.0.0
 R3(config-router)#no auto-summary
 R3(config-router)#end

Verifiering – L3

S1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
172.16.0.0/24 is subnetted, 6 subnets
C 172.16.40.0 is directly connected, Vlan40
C 172.16.30.0 is directly connected, Vlan30
C 172.16.20.0 is directly connected, Vlan20
C 172.16.13.0 is directly connected, FastEthernet0/4
D 172.16.10.0 [90/28416] via 172.16.40.200, 00:01:51, Vlan40
C 172.16.1.0 is directly connected, Loopback0
R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
172.16.0.0/24 is subnetted, 6 subnets
C 172.16.40.0 is directly connected, FastEthernet0/1.40
D 172.16.30.0 [90/28416] via 172.16.40.1, 00:02:35, FastEthernet0/1.40
D 172.16.20.0 [90/28416] via 172.16.40.1, 00:02:35, FastEthernet0/1.40
D 172.16.13.0 [90/30720] via 172.16.40.1, 00:02:35, FastEthernet0/1.40
C 172.16.10.0 is directly connected, FastEthernet0/1.10
D 172.16.1.0 [90/156160] via 172.16.40.1, 00:02:35, FastEthernet0/1.40
S1#ping 172.16.40.200
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms
S1#ping 172.16.10.200
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
S1#ping 172.16.40.2
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms
R3#ping 172.16.40.2
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Verifiering L2

S3#sh interface trunk
Port Mode Encapsulation Status Native vlan
Fa0/3 on isl trunking 1
Fa0/5 on 802.1q trunking 1
Po1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/3 1-4094
Fa0/5 10,40
Po1 1-4094
S1#sh spanning-tree summary
Switch is in pvst mode
Root bridge for: VLAN0001, VLAN0010, VLAN0020, VLAN0030, VLAN0040
S2#sh etherchannel summary
Flags: D - down P - bundled in port-channel
 I - stand-alone s - suspended
 H - Hot-standby (LACP only)
 R - Layer3 S - Layer2
 U - in use f - failed to allocate aggregator
M - not in use, minimum links not met
 u - unsuitable for bundling
 w - waiting to be aggregated
 d - default port

Number of channel-groups in use: 2
Number of aggregators: 2
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) LACP Fa0/1(P) Fa0/2(P) 
2 Po2(SU) LACP Fa0/3(P) Fa0/4(P)

Härligt! Stötte på lite problem under labben då det visade sig att interfacet jag tänkte använda mellan Switch & Router inte var directly connected. Det var inga problem att sätta upp trunkingen etc men trafiken fastnade i någon dold switch eller dylikt. Från början var det tänkt att Routern skulle vara ansluten till S2 men det fanns tyvärr inget interface att använda där som fungerade. Fick istället göra om ritningen lite och använda länken mellan R3-S3 men det fungerade ju precis lika bra efter lite mindre modifieringar. 🙂 Kul labb!

MDH Lab – Inter-VLAN MLS Routing

Topologi

lab4-2real

Objective

  • Route between VLANs using a 3560 switch with an internal route processor using Cisco Express Forwarding (CEF).

Background

The current network equipment includes a 3560 distribution layer switch and two 2960 access layer switches. The network is segmented into three functional subnets using VLANs for better network management. The VLANs include Finance, Engineering, and a subnet for equipment management, which is the default management VLAN, VLAN 1. After VTP and trunking have been configured for the switches, switched virtual interfaces (SVI) are configured on the distribution layer switch to route between these VLANs, providing full connectivity to the internal network.

Genomförande

Easy! Blir inte så mycket förklaringar här då all konfig är rätt självklar. Först fixar vi upp grundkonfigen:

S1

Switch(config)#hostname S1
S1(config)#line con 0
S1(config-line)#logging sync
S1(config-line)#int range fa0/3 - 4
S1(config-if-range)#switchport trunk encaps dot1q
S1(config-if-range)#switchport mode trunk
S1(config-if-range)#channel-protocol pagp
S1(config-if-range)#channel-group 2 mode desirable 
Creating a port-channel interface Port-channel 2
S1(config-if-range)#int range fa0/1 - 2
S1(config-if-range)#switchport trunk encaps dot1q
S1(config-if-range)#switchport mode trunk
S1(config-if-range)#channel-protocol pagp
S1(config-if-range)#channel-group 1 mode desirable
Creating a port-channel interface Port-channel 1
S1(config-if-range)#exit
S1(config)#vtp mode server
Device mode already VTP SERVER.
S1(config)#vtp domain Cisco
Changing VTP domain name from NULL to Cisco
S1(config)#vlan 100
S1(config-vlan)#name Finance
S1(config-vlan)#vlan 200
S1(config-vlan)#name Engineering
S1(config-vlan)#exit
S1(config)#spanning-tree vlan 1,100,200 root primary 
S1(config)#

S3

Switch(config)#hostname S3
S3(config)#line con 0
S3(config-line)#logging sync
S3(config-line)#int range fa0/1 - 4
S3(config-if-range)#switchport trunk encaps dot1q
S3(config-if-range)#switchport mode trunk
S3(config-if-range)#int range fa0/1 - 2
S3(config-if-range)#channel-protocol pagp
S3(config-if-range)#channel-group 1 mode desirable 
Creating a port-channel interface Port-channel 1
3(config-if-range)#int range fa0/3 - 4
S3(config-if-range)#channel-protocol pagp
S3(config-if-range)#channel-group 2 mode auto
Creating a port-channel interface Port-channel 2
S3(config-if-range)#exit
S3(config)#vtp domain Cisco
Domain name already set to Cisco.
S3(config)#vtp mode client
Setting device to VTP CLIENT mode.

S2

Switch(config)#hostname S2
S2(config)#int range fa0/1 - 4
S2(config-if-range)#switchport mode trunk
S2(config-if-range)#int range fa0/1 - 2
S2(config-if-range)#channel-protocol pagp
S2(config-if-range)#channel-group 1 mode auto
Creating a port-channel interface Port-channel 1
S2(config-if-range)#int range fa0/3 - 4
S2(config-if-range)#channel-protocol pagp
S2(config-if-range)#channel-group 2 mode auto
Creating a port-channel interface Port-channel 2
S2(config-if-range)#exit
S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
S2(config)#vtp domain Cisco
Domain name already set to Cisco.
S2#sh etherchannel summary
Flags: D - down P - bundled in port-channel
 I - stand-alone s - suspended
 H - Hot-standby (LACP only)
 R - Layer3 S - Layer2
 U - in use f - failed to allocate aggregator
M - not in use, minimum links not met
 u - unsuitable for bundling
 w - waiting to be aggregated
 d - default port

Number of channel-groups in use: 2
Number of aggregators: 2
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) PAgP Fa0/1(P) Fa0/2(P) 
2 Po2(SU) PAgP Fa0/3(P) Fa0/4(P)
S3#sh etherchannel summary
Flags: D - down P - bundled in port-channel
 I - stand-alone s - suspended
 H - Hot-standby (LACP only)
 R - Layer3 S - Layer2
 U - in use f - failed to allocate aggregator
M - not in use, minimum links not met
 u - unsuitable for bundling
 w - waiting to be aggregated
 d - default port

Number of channel-groups in use: 2
Number of aggregators: 2
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) PAgP Fa0/1(P) Fa0/2(P) 
2 Po2(SU) PAgP Fa0/3(P) Fa0/4(P)

Allt ok så långt!

Så då återstår det bara att konfa upp lite L3 SVI’s, vilket är oerhört enkelt egentligen.

S1(config)#interface vlan 1
S1(config-if)#ip add 172.16.1.1 255.255.255.0
S1(config-if)#no shut
S1(config-if)#interface vlan 100
S1(config-if)#ip add 172.16.100.1 255.255.255.0
S1(config-if)#no shut
S1(config-if)#interface vlan 200
S1(config-if)#ip add 172.16.200.1 255.255.255.0
S1(config-if)#no shut
S1(config-if)#exit

Lätt att glömma är att vi även måste aktivera routing-funktionen i switchen!

S1(config)#ip routing

Vi har ju tyvärr ingen host att testa med nu men vi kan åtminstone dra en ping från S3 till något av S1’s vlan.

S3(config)#int vlan 1
S3(config-if)#ip add 172.16.1.3 255.255.255.0
S3(config-if)#no shut
S3(config-if)#exit
S3(config)#ip default-gateway 172.16.1.1
S3(config)#do ping 172.16.200.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.200.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/203/1007 ms

Vackert.

Om vi tar en titt i CEF-table för 172.16.1.3 kan vi se följande:

S1#sh ip cef 172.16.1.3 detail
 172.16.1.3/32, epoch 2, flags attached
 Adj source: IP adj out of Vlan1, addr 172.16.1.3 038C1420
 Dependent covered prefix type adjfib cover 172.16.1.0/24
 attached to Vlan1

Och switchen har även ett entry i adjacency-table med L2-information för nexthop (S3):

S1#sh adjacency detail
Protocol Interface Address
IP Vlan1 172.16.1.3(8)
0 packets, 0 bytes
epoch 0
sourced in sev-epoch 0
Encap length 14
0014A8899CC00024C33F9EC00800
L2 destination address byte offset 0
L2 destination address byte length 6
Link-type after encap: ip
ARP