Introduction xx Chapter 1 Fundamentals Review 1 Switching Introduction 2 Hubs and Switches 2 Bridges and Switches 2 Switches of Today 3 Broadcast Domains 3 MAC Addresses 4 The Basic Ethernet Frame Format 4 Basic Switching Function 5 VLANs 6 The Spanning Tree Protocol 6 Trunking 7 Port Channels 7 Multilayer Switching 8 Summary 8 Chapter 2 Network Design Fundamentals 9 Campus Network Structure 9 Hierarchical Network Design 10 Access Layer 12 Distribution Layer 13 Core Layer (Backbone) 14 Layer 3 in the Access Layer 17 The Cisco Enterprise Campus Architecture 19 The Need for a Core Layer 20 Types of Cisco Switches 22 Comparing Layer 2 and Multilayer Switches 24 MAC Address Forwarding 24 Layer 2 Switch Operation 25 Layer 3 (Multilayer) Switch Operation 26 Useful Commands for Viewing and Editing Catalyst Switch MAC Address Tables 27 Frame Rewrite 28 Distributed Hardware Forwarding 28 Cisco Switching Methods 29 Route Caching 30 Topology-Based Switching 31 Hardware Forward Details 33 Study Tips 34 Summary 34 Review Questions 35 Chapter 3 Campus Network Architecture 41 Implementing VLANs and Trunks in Campus Environment 41 VLAN Overview 42 VLAN Segmentation 44 End-to-End VLANs 44 Local VLANs 45 Comparison of End-to-End VLANs and Local VLANs 46 Mapping VLANs to a Hierarchical Network 47 Implementing a Trunk in a Campus Environment 49 Understanding Native VLAN in 802.1Q Trunking 52 Understanding DTP 53 VLAN Ranges and Mappings 54 Configuring, Verifying, and Troubleshooting VLANs and Trunks 55 Verifying the VLAN Configuration 57 Configuring VLANs and Trunks 61 Best Practices for VLANs and Trunking 65 Voice VLAN Overview 67 Switch Configuration for Wireless Network Support 69 VLAN Trunking Protocol 70 VTP Overview 70 VTP Modes 71 VTP Versions 73 VTP Pruning 74 VTP Authentication 75 VTP Advertisements 75 VTP Messages Types 77 Summary Advertisements 77 Subset Advertisements 77 Configuring and Verifying VTP 78 Overwriting VTP Configuration (Very Common Issue with VTP) 87 Best Practices for VTP Implementation 93 Implementing EtherChannel in a Switched Network 94 The Need for EtherChannel 94 EtherChannel Mode Interactions 97 LACP 97 PAgP 98 Layer 2 EtherChannel Configuration Guidelines 99 EtherChannel Load-Balancing Options 100 Configuring EtherChannel in a Switched Network 102 EtherChannel Configuration and Load Balancing 103 EtherChannel Guard 108 Study Tips 109 Summary 110 Review Questions 110 Chapter 4 Spanning Tree in Depth 119 Spanning Tree Protocol Overview 120 STP Need 120 STP Standards 121 STP Operations 122 Bridge Protocol Data Units 124 Root Bridge Election 124 Root Port Election 126 Designated Port Election 128 STP Port States 129 Per-VLAN STP Plus (PVST+) 130 STP Topology Changes 131 Rapid Spanning Tree Protocol 133 RSTP Port Roles 134 Comparison of RSTP and STP Port States 135 RSTP Topology Changes 136 RSTP Link Types 138 Configuring and Modifying STP Behavior 140 Changing STP Priority 143 STP Path Manipulation 145 STP Timers 148 Implementing STP Stability Mechanisms 151 Use UplinkFast 153 Use BackboneFast 154 Use PortFast 156 Securing PortFast Interface with BPDU Guard 158 Disabling STP with BPDU Filter 159 Use Root Guard 161 Loop Guard Overview 164 Use UDLD 166 UDLD Recommended Practices 170 Use FlexLinks 171 STP Stability Mechanisms Recommendations 175 Configuring Multiple Spanning Tree Protocol 179 Introducing MST 179 MST Regions 182 STP Instances with MST 183 Extended System ID for MST 185 Configuring and Verifying MST 185 Configuring MST Path Cost 192 Configuring MST Port Priority 193 MST Protocol Migration 194 MST Recommended Practices 194 Troubleshooting STP 196 Potential STP Problems 196 Duplex Mismatch 196 Unidirectional Link Failure 197 Frame Corruption 197 Resource Errors 198 PortFast Configuration Errors 198 Study Tips 198 Summary 199 Review Questions 200 Chapter 5 Inter-VLAN Routing 203 Describing Inter-VLAN Routing 204 Introduction to Inter-VLAN Routing 204 Inter-VLAN Routing Using an External Router 206 Configuring Inter-VLAN Routing Using an External Router 207 Routing with an External Router 208 External Routers: Advantages Disadvantages 211 Inter-VLAN Routing Using Switch Virtual Interfaces 212 SVI: Advantages and Disadvantages 214 Routing with Routed Ports 214 Routed Ports: Advantages 215 Configuring Inter-VLAN Routing Using SVI and Routed Ports 216 Routing on a Multilayer Switch 217 Using the SVI autostate exclude Command 220 SVI Configuration Checklist 221 Troubleshooting Inter-VLAN Problems 222 Example of a Troubleshooting Plan 223 Layer 2 Versus Layer 3 EtherChannel 225 Layer 3 EtherChannel Configuration 226 Verifying Routing Protocols 229 Implementing DHCP 231 DHCP Overview 231 Configuring DHCP in Multilayer Switched Network 233 Configuring a DHCP Relay 239 Configuring DHCP Options 239 Study Tips 240 Summary 241 Review Questions 242 Chapter 6 First-Hop Redundancy 247 Overview of FHRP and HSRP 247 The Need for First-Hop Redundancy 248 HSRP Overview 250 HSRP State Transition 253 Aligning HSRP with STP Topology 254 Configuring and Tuning HSRP 255 Forwarding Through the Active Router 257 Load Sharing with HSRP 263 The Need for Interface Tracking with HSRP 265 HSRP Interface Tracking 266 HSRP and Object Tracking 268 Configuring HSRP Authentication 271 Tuning HSRP Timers 272 HSRP Versions 274 Configuring Layer 3 Redundancy with VRRP 274 About VRRP 275 Configuring VRRP and Spotting the Differences from HSRP 276 VRRP and Authentication 279 Tracking and VRRP 280 Configuring Layer 3 Redundancy with GLBP 282 Introducing GLBP 282 Comparing GLPB to HSRP 283 GLBP States 284 Configuring and Verifying GLBP 285 GLBP Load-Balancing Options 294 GLBP Authentication 295 GLBP and STP 295 Tracking and GLBP 296 Study Tips 300 Summary 301 References 301 Review Questions 302 Chapter 7 Network Management 305 AAA 305 Authentication Options 307 RADIUS and TACACS+ Overview 308 RADIUS Authentication Process 309 TACACS+ Authentication Process 310 Configuring AAA 311 Configuring RADIUS for Console and vty Access 311 Configuring TACACS+ for Console and vty Access 312 AAA Authorization 313 AAA Accounting 314 Limitations of TACACS+ and RADIUS 315 Identity-Based Networking 316 IEEE 802.1X Port-Based Authentication Overview 316 IEEE 802.1X Configuration Checklist 318 Network Time Protocols 319 The Need for Accurate Time 320 Configuring the System Clock Manually 320 Network Time Protocol Overview 323 NTP Modes 324 Other NTP Configuration Options 326 NTP Example 326 NTP Design Principles 329 Securing NTP 331 NTP Source Address 333 NTP Versions 333 SNTP 335 PTP/IEEE-1588 336 SNMP 336 SNMP Overview 337 SNMP Versions 339 SNMP Best Practices 339 SNMPv3 Configuration Example 340 Verifying SNMP Version 3 Configuration 342 Study Tips 344 Summary 345 Review Questions 345 Chapter 8 Switching Features and Technologies for the Campus Network 351 Discovery Protocols 352 Introduction to LLDP 352 Basic Configuration of LLDP 353 Discovering Neighbors Using LLDP 355 Unidirectional Link Detection 357 UDLD Mechanisms and Specifics 358 UDLD Configuration 358 Leveraging UDLD and STP Loop Guard Together 360 Power over Ethernet 360 PoE Components 362 PoE Standards 362 PoE Negotiation 362 Configuring and Verifying PoE 363 SDM Templates 364 SDM Template Types 365 Choosing the Right SDM Template 367 System Resource Configuration on Other Platforms 367 Monitoring Features 368 SPAN and RSPAN Overview 368 SPAN Configuration 371 RSPAN Configuration 372 IP SLA 374 Introduction to IP SLA 375 IP SLA Source and Responder 377 IP SLA Configuration 377 IP SLA Operation with Responder 379 IP SLA Time Stamps 381 Configuring Authentication for IP SLA 382 IP SLA Example for UDP Jitter 383 Study Tips 384 Summary 385 Review Questions 385 Chapter 9 High Availability 393 The Need for Logical Switching Architectures 394 What Is StackWise? 395 StackWise Benefits 396 Verifying StackWise 396 What Is VSS? 397 VSS Benefits 398 Verifying VSS 399 Redundant Switch Supervisors 401 Supervisor Redundancy Modes 402 Stateful Switchover 403 Nonstop Forwarding 404 Study Tips 405 Summary 405 Review Questions 406 References 406 Chapter 10 Campus Network Security 409 Overview of Switch Security Issues 410 Cisco Switch Security Configuration Best Practices 411 Campus Network Vulnerabilities 414 Rogue Access 414 Switch Vulnerabilities 415 MAC Flooding Attacks 417 Introducing Port Security 419 Port Security Configuration 420 Port Error Conditions 422 Err-Disabled Automatic Recovery 423 Port Access Lists 424 Storm Control 425 Introduction to Storm Control 426 Configuring and Verifying Storm Control on an Interface 427 Mitigating Spoofing Attacks 430 DHCP Spoofing Attacks 430 DHCP Snooping 432 DHCP Option 82 433 DHCP Snooping Example Configuration 433 IP Source Guard 436 IPSG Configuration 438 ARP Spoofing 439 Dynamic ARP Inspection 440 DAI Configuration 441 Securing VLAN Trunks 443 Switch Spoofing 444 VLAN Hopping 446 Protecting Against VLAN Hopping 447 VLAN Access Lists 448 VACL Interaction with ACLs and PACLs 449 Configuring VACLs 450 Private VLANs 451 Introduction to PVLANs 452 PVLAN Port Types 453 PVLAN Configuration 454 PVLAN Verification 456 PVLANs Across Multiple Switches 457 Using the Protected Port Feature 458 Study Tips 458 Summary 459 Review Questions 460 Appendix A Answers to Chapter Review Questions 469 9781587206641 TOC, 4/14/2015