13 - Redundancy in the Campus - HSRP, VRRP, and GLBP 2

One other difference between VRRP and the other 2 protocols in regards to timers is that the master down interval (hold timer) is not configurable.  Instead, VRRP uses a value of 3 times the hello timer + the skew time as the master down interval.  The skew time is calculated as ((256 – VRRP priority) / 256), which will result in higher priority routers having a shorter skew time and master down interval.

For this lab, we will have to do it on the 2800, as VRRP is not supported on the 3550 ... (maybe another reason to run HRSP as that is supported on all cisco platforms)

VERY SIMILAR TO HRSP:

inter fa0/0

vrrp 20 ip 172.30.4.90

vrrp 20 preempt

vrrp 20 timers advertise msec 100

Dont have option to set dead timer like we did with HRSP, it will learn the timer from the hello timer

timers that are set on the MASTER - so on the MASTER we set advertise, and the backup hosts are configured as learn and they will learn this dynamically.

If MASTER notices if one of its tracked interfaces is down, it will set its priority to zero

server 1 = wants to send traffic, sends arp for VIP, router 1 gets arp request, he sends the mac addy,

server 2 = wants to send traffic, sends arp for VIP, router 2 gets arp request and passes to the AVG, but when he replies he replies with the MAC of R2.

Also R2 is now known as the AVF

The load balancing can be round robin, host dependent or weighted (equal or unequal) - is it true load-balancing ... well no, but it is a type of load balancing (it doesn't sit there idle) 

for other weighing (ie not the default round robin) you have to configure quite abit of options (not covered in NP)

Config very similar as others:

inter fa0/0

glbp 1 ip 172.30.4.70

glbp 1 priority 150 (to set who is AVG) higher = better, default is 100

glbp 1 timers 

supports IPv6 also!

14 - Campus Security - Basic Port Security and 802.1x

part of dsniff is macof which sources many, many MACs to that uplink which saturates that CAM table, which then turns the switch into a hub (as no more MACs can be learnt) now everything is braodcast, you can packet sniff it ;0)

most attacks focus on poisoning the MAC tables

See screenshot of when i used MACOF against my 2950 when study for the CCNA-S, check out the 8000+ MACs learnt by the switch! lol

conf t
inter fas0/21
switchport mode access
switchport port-security
switchport port-security maximum 1


show port-security inter fas0/21 to verify

switchport port-security violation
shutdown - your gonna hear about it, good choice to choose
restrict - does the same as protect, but the security violation counter will increase and will generate a SYSLOG event.
protect - when another MAC tries to connect, it will ignore them (but you the admin and user dont know about it)


state of the port goes into secure-shutdown, check in show ip int brief (shows as down/down)
Handy command to view this is:

we just saw security-violation, so lets configure that:

conf t
errdisable recovery cause security-violation
errdisable recovery interval X (secs)

pretty kool huh .... :0)


show port-security interface fa 0/21 to see the security information and counters

conf t
inter fas 0/21
switchport port-security max 10
switchport port-security mac-address *static IP*

BUT DO CONFIG as we have above the max macs allowed too, but be careful as it works a mix, i.e
it will allow the x1 MAC we configured plus 9 sticky ones. So configure as appropriate.

or we can do this with sticky macs


switchport port-security mac-address sticky

the switch will automatically hard-coded whatever device you have plugged into that switchport,

you need to save the config to nvram otherwise the configure will not be saved, also if we plug in another device you can see the running configure shows that mac also :0)

if these are the only two devices, we can then lower the maximum down to 2, job done lol

802.1x

Authenticator does not need to understand EAP, it is transparent in the process, so if at a later date we used a different security algorithm we dont have to upgrade the switch. 


handy link:
http://www.cs.umd.edu/~mvanopst/8021x/howto/

To configure on the switch, we need AAA and to enable 802.1x globally:

12 - Redundancy in the Campus - HSRP, VRRP, and GLBP 1

However you can tweak the timers to be just as good as VRRP, so the only thing against it is the fact it is only for cisco.

So first, lets jump on switch A (70.2)

Switch A
inter vlan 70
standby 1 ip 172.30.70.1
standby 1 priority 150  (default 100, HIGHER is better!)..otherwise relies on IP to break tie


Switch C
inter vlan 70
standby 1 ip 172.30.70.1

Lets jump on the client/host
and we can now ping 172.30.70.1 :0)
also if we telnet to 70.1 we land on SwitchA - just as you would expect what with the higher priority (its ACTIVE)

lets test it out, lets pull out the uplink between the switches,

Ah, so HRSP kicked in, lets check the switch, if we now telnet to the VIP address, we land on Switch C

BUT, notice if we patch Switch A back in, Switch C is STILL the active switch, even though Switch A has the higher priority ... its kinda a 1 deal fail over really, when Switch C fails it will then failover to Switch A

We can tweak HRSP with these commands:

Priority we know, however with preempt we can fix the issue above:


Switch A

inter vlan 70
standby 1 preempt

This will overthrow the lower priority Switch straightaway, once the command is entered.



Tracking is configured with Preempt, they go hand in hand as when it detects the interface has gone down it will then decrement its priority, it then needs the preempt feature to then over throw the current Switch

Lets setup the above:

SWITCH A
has priority of 150 and will decrement 60 to 90 if the interface goes down, therefore allowing Switch C to be ACTIVE



Switch C
inter vlan 70
standby 1 preempt


Switch A
inter vlan 70
standby 1 track fas 0/23 60


Right lets ull the uplink:

WOW! no loss! lets check at SWITCH C is ACTIVE

Notice the STANDBY router has a priority of 90! as it took 60 off for the interface going down because of the tracker

We can also tweak it with Delay:

Lets tune them timers! notice we can get tweak this to be the same as VRRP, BUT why do that when we can get into milli-seconds!!!

Now we can re-converge faster than 1 second!!! might just want to keep an eye on processor cycle on both the switches (so there will be interrupts to the processor for that)

11 - L3 Switching - Understanding CEF Optimization

A foundation look at what exactly CEF is and how it works:

When switch boots up, everything has to be learnt (routes etc) this is then copied down to the FIB

FIB = Forwarding Information Base (Which is a high speed cache in the ASIC)

The ADJ table holds all the Layer 2 information (Mac etc)

Now once the switch has booted up, the switch proactivly checks all the routes in the FIB and then finds all the MAC addresses for the next hop addresses (upstream routers/L3/static etc)

So by the time this switch/router is ready to forward packets it already has the entire routing table cached and it has all the ARP mappings/next hop MAC addresses.

So now when a packet comes into the router/switch it comes straight into the hardware, looks at hardware cache /routing table, has MAC already, swaps the header and out it goes at WIRE SPEED at LAYER 3!

So all inter-vlan traffic, routed ports and routing all happens in CEF at wire speed. Major advantage

Now days all L3 switches come with CEF enabled by default, meaning you have to disable it if you dont want it.

to enable

conf t

ip cef

handy command/feature to find bandwidth hogs (ip cef traffic-statistics)

You can run the command on the VLANS,:

so the switch has all these prefixes/routes in its FIB, also if we check the ARP table we can see this has been

moved in the adjacency table for CEF, 

So when copying data from one host to another in different VLANS, we dont need an routing lookups (we have it all already), it has it all already and off it goes!

08 - STP - Rapid Spanning Tree Concepts and Configuration

portfast - on the host links interface range <ports>
spanning-tree port fast

To enable RSTP
spaning-tree mode rapid-pvst - do this on all the switches participating

Im going to uplug the uplink between Switch B and A, we should see the port change from altn/BLK to FWD straight away

we did not see any loss!!!! - compare this to STP - BIG DIFFERENCE!

 

9 - EtherChannel - Aggregating Redundant Links

Can bundle upto 8 ports
You get aggregated bandwidth, no wasted bandwidth, also load-balancing
Automatic failover if one of the links fails.
Its logical too, so this simplifies the management (apply config to etherchannel not the ports)

PAGP: If both auto, it wont be an etherchannel, one side has to be in desirable state.
best way to hard code both to ON

Only difference between the modes, well mainly the PAGP is cisco propietary and was invented first before a industry standard was around! Cisco kept it on and now you have a choice ... BUT obviously PAGP is cisco kit only.

L2  etherchannel
simple bundling of ports, Layer 2 domain

L3 etherchannel
you can put all ports in layer2, but assign them to a port channel interface, so you could have routing between your distribution layer and core layer, it allows for very fast convergence at the access layer! which some people are doing now. have routing at all layers.



Lets start with the Layer 2 etherchannel first:

config wise, just going with something simple, i have chosen PAGP:

inter range fas 0/23 - 24
channel-protocol pagp
channel-group 1 mode desirable

Modes shown here:

Once configured on both sides, a neat command is show etherchannel detail - handy nice layout of information (bonus of showing load of port-channel too)

Building upon the original configuration:


Need to remove the port-channel as we have negotiated a Layer 2 Etherchannel and it would of not allowed us to apply the switchport first.

inter range fas 0/23 - 24
no channel-group 1
no switchport  <--- Enable layer3
channel-group 1 mode desirable

interface port-channel 1
no switchport   <--- Enable layer3
ip address 10.1.1.1 255.255.255.0

The last point does not affect the port-channel! only the port .... so if you apply config moving it in a different VLAN etc it will be dropped from the bundle.

10 - L3 Switching - InterVLAN Routing Extraordinaire

*didnt doc this as its pretty basic and i know it inside out,

Okay and i can ping from both hosts to both the respective vlans/SVI's

Lets look at the next part:

So we can turn fa0/24 into a routed port! lets do that:

10.1.24.2 is the router the other end of the link, the router is also running EIGRP, lets enable THAT TOOO.

We have an EIGRP neighbour, lets check the routing table

How kool is that! we have "SWOUTER" lol! SWEEET!

Dont ask about the diagram, if your have seen the CBT nugget your'll get it lol:

Packet goes to the router, so once the first packet has been to the router, all future
packets go to the hardware part of the switch (ASIC)/CEF and they just fly by!



Layer3 vs Multilayer switching

L3 = switch has a router in it
multilayer = has ability to cache route info (CEF)

every L3 switch is a multilayer switch
however not every multilayer switch is a L3 switch