Showing posts with label VLAN. Show all posts

Router on a Stick and SVI configuration

by Shabeeribm

Router on stick method and SVI (Switched Virtual Interface) are used for Inter-Vlan communication. [For detailed notes on vlan and intervlan visit this link]

Router on stick Configuration
Configuration on switch connected to router
Switch(config)#interface fa0/10

Switch(config-if)#switchport trunk encapsulation dot1q

Switch(config-if)#switchport mode trunk

This is how we configure Switch.Interface between switch and router must be configured as trunk port.

Router(config)#interface fa0/0.10

Router(config-subif)#encapsulation dot1Q 10

Router(config-subif)#ip address 192.168.10.254 255.255.255.0
Router(config-subif)#exit

Router(config)#interface fa0/0.20

Router(config-subif)#encapsulation dot1Q 20

Router(config-subif)#ip address 192.168.20.254 255.255.255.0
Router(config-subif)#exit

Create two sub-interfaces on the router and tell it to which VLAN they belong. Don't forget to add an IP address for each VLAN.

NOTE : Don't forget to set your IP address and gateway on the computers.

SVI (Switched Virtual Interface) Configuration
Switch(config)#ip routing
Switch(config)#interface vlan 10
Switch(config-if)#no shutdown
Switch(config-if)#ip address 192.168.10.254 255.255.255.0
Switch(config)#interface vlan 20
Switch(config-if)#no shutdown
Switch(config-if)#ip address 192.168.20.254 255.255.255.0

Start by enabling routing using the "ip routing" command as we know routing is not enabled by default in switches. Next step is to create a SVI for VLAN 10 and 20 and configure IP addresses on them

NOTE : Don't forget to set your IP address and gateway on the computers.

Vlan Interview Questions and Answers

by Shabeeribm

Vlan Interview Questions and Answers

Click here to view VLAN Notes

Which switching technology reduces the size of a broadcast domain?
VLAN

Which protocols are used to configure trunking on a switch?
802.1Q

What is SVI ?
Switched Virtual Interface (SVI) is a virtual interface which provides a routed gateway into and out of a VLAN

what is meant by "router on stick" ?
Router on Stick is a method used for communicating Inter-VLAN's using a router

which is the default mode in switch ports ?
Older switches are dynamic desirable by default and modern switches are dynamic auto by default

Difference between 802.1Q and ISL ?

Cisco ISL (Inter-Switch Link) is an old Cisco proprietary protocol that is only supported on some Cisco switches. While 802.1Q [dot1Q] is a open standard protocol that is supported on switches from many vendors and most NICs.

What VTP mode allows you to change VLAN information on the switch?
Server mode

Which are the two trunking protocols ?
ISL and IEEE 802.1Q

Which Protocol encapsulate Etherframes ?
ISL encapsulate ethernet frames while 802.1Q tags ethernet frame

Which is the Vlan not tagged by 802.1Q ?
Native Vlan

How to delete vlan information from switch ?
VLAN information is not saved in the running-config or startup-config but in a separate file called vlan.dat on your flash memory. If you want to delete the VLAN information you should delete this file by typing delete flash:vlan.dat.

Difference between access and trunk mode ?
Access mode is used to connect end devices(hosts) to switches while trunk mode is used to connect between switches

Difference between dynamic auto and dynamic desirable ?

dynamic desirable : Attempts to negotiate a trunk with the other end
dynamic auto : Forms a trunk only if requested by the other end

what is the use of "nonegociate" command in switch ?
"nonegociate" command disables automatic formation of trunk links.It will be good to configure trunk manually and give non-negociate command for security reason

Explain different switch port modes ?

Trunk : Forms an unconditional trunk

dynamic desirable : Attempts to negotiate a trunk with the far end

dynamic auto : Forms a trunk only if requested by the far end

access : Will never form a trunk

what is DTP ?

Dynamic Trunking Protocol (DTP) is used to automatically establish trunks between capable ports (insecure method!)

Can we see trunk interfaces in show vlan command ?Nope

which is the command used to see trunk interfaces ?

show interface trunk
show interface Fa1/0/13 trunk
show interface Fa1/0/13 switchport
show interfaces status | include trunk

what is the maximum number of vlans permitted in 802.1Q and ISL ?

Maximum Vlan permitted in 802.1Q is 4094

Maximum Vlan permitted in ISL is 1000

what is the header size of 802.1Q ?
4 bytes

what is the header size of ISL ?
26 bytes

Click here to View and download complete CCNA / CCNP notes and interview questions for $ 5

CCNP : Configuring VLAN ACLs

by Shabeeribm

VLAN ACL (VACL)

We know ACL (Access list) is used to permit and deny traffic.By using VACL,we can control forwarding or denying of packets that are routed into or out of a VLAN or are bridged within a VLAN. VACLs are strictly for security packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by direction (ingress or egress).

Terms used with VLAN ACLs

Access MAP
VACLs use access maps to contain an ordered list of one or more map entries. Each map entry associates a ACLs to an action. Each entry has a sequence number, which allows you to control the precedence of entries.

Actions
Each VLAN access map entry can specify one of the following actions:
• Forward—Sends the traffic to the destination determined by normal operation of the switch.
• Redirect—Redirects the traffic to one or more specified interfaces.
• Drop—Drops the traffic. If you specify drop as the action, you can also specify that the device logs
the dropped packets.
In access map configuration mode, you use the action command to specify the action for a map entry

Creating of VLAN ACL includes 3 steps

Create Access-List
Create Access MAP
Apply on VLAN

Configuring Access list

Switch#conf terminal

Switch(config)#ip access-list standard 10

Switch(config-std-nacl)#permit 172.120.40.0 0.0.0.255

Switch(config-std-nacl)#exit

Create Access MAP

Switch(config)#vlan access-map SYSNET 1

Switch(config-access-map)#match ip address 10

Switch(config-access-map)#action forward

Switch(config-access-map)#exit

Switch(config)# vlan access-map SYSNET 2

Switch(config-access-map)# action drop

Switch(config-access-map)# exit

Explanation

”1″ is the line number 1 of the access-map named “SYSNET”
”10″ is the access-list number used to identify the ACL
This is the action that will be applied to the traffic matched on ACL “10″ .Here we need to allow traffic so we give "action forward
Even there is a implicit deny at the end like normal ACL,here we giving "action drop" statement to deny other traffic

Apply on VLAN

Switch(config)#vlan filter SYSNET vlan-list 20Switch(config)#(config)#exit

Applies the VLAN access-map named “SYSNET” to vlan 20.

To remove VLAN ACL

Switch(config)#no vlan access-map map-name [sequence-number]

What is VLAN Hopping

by Shabeeribm

VLAN Hopping

VLAN hopping is a security threat , a method of attacking networked resources on a Virtual LAN (VLAN). The basic concept behind all VLAN hopping attacks is where a user can gain access to a VLAN not assigned to the switch port to which the user connects..

There are two primary methods of VLAN hopping: switch spoofing and double tagging. Both attacks can be easily mitigated with proper switchport configuration

The first and most commonly used VLAN hopping method is where the attacker makes his workstation act as a trunk port

To overcome this kind of VLAN hopping attack, you must follow below steps

1. Ensure that ports are not set to negotiate trunks automatically.

Switch(config-if)# switchport nonegotiate

2. Ensure that ports that are not meant to be trunks are explicitly configured as access ports

Switch(config-if)# switchport mode access

The second way an attacker can hop VLANs is by using double tagging. With double tagging, the attacker inserts a second 802.1q tag in front of the existing 802.1q tag. This relies on the switch stripping off only the first 802.1q tag and leaving itself vulnerable to the second tag. This is not as common a method of VLAN hopping as using trunking.

Mitigation

Simply do not put any hosts on VLAN 1 (The default VLAN). i.e., assign an access VLAN other than VLAN 1 to every access port

Switch(config-if)# switchport access vlan 2

Change the native VLAN on all trunk ports to an unused VLAN ID.

Switch(config-if)# switchport trunk native vlan 999

Explicit tagging of the native VLAN on all trunk ports.

Switch(config-if)# switchport trunk native vlan tag

Example
As an example of a double tagging attack, consider a secure web server on a VLAN called VLAN1. Hosts on VLAN1 are allowed access to the web server; hosts from outside the VLAN are blocked by layer 3 filters.

An attacking host on a separate VLAN, called VLAN2, creates a specially formed packet to attack the web server. It places a header tagging the packet as belonging to VLAN2 on top of another header tagging the packet as belonging to VLAN1. When the packet is sent, the switch on VLAN2 sees the VLAN2 header and removes it, and forwards the packet.

The VLAN2 switch expects that the packet will be treated as a standard TCP packet by the switch on VLAN1. However, when the packet reaches VLAN1, the switch sees a tag indicating that the packet is part of VLAN1, and so bypasses the layer 3 handling, treating it as a layer 2 packet on the same logical VLAN. The packet thus arrives at the target server as though it was sent from another host on VLAN1, ignoring any layer 3 filtering that might be in place.

Via :Wikipedia

Dynamic Trunking Protocol (DTP)

by Shabeeribm

Dynamic Trunking Protocol (DTP) is the Cisco-proprietary protocol that actively attempts to negotiate a trunk link between two switches. Below is the switchport modes (or DTP modes) for easy reference:

Mode	Function
Dynamic Auto	Creates the trunk based on the DTP request from the neighboring switch.
Dynamic Desirable	Communicates to the neighboring switch via DTP that the interface would like to become a trunk if the neighboring switch interface is able to become a trunk.
Trunk	Automatically enables trunking regardless of the state of the neighboring switch and regardless of any DTP requests sent from the neighboring switch.
Access	Trunking is not allowed on this port regardless of the state of the neighboring switch interface and regardless of any DTP requests sent from the neighboring switch.
Nonegotiate	Prevents the interface from generating DTP frames. This command can be used only when the interface switchport mode is access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link.

Below figure shows the combination of different modes

Difference between End-to-end VLANs and Local VLANs

by Shabeeribm

End-to-end VLANs are positioned to support maximum flexibility and mobility of end devices. Users can be assigned to VLANs regardless of their physical location. As a user moves around the campus, that user’s VLAN membership stays the same. End-to-end VLANs should group users according to common requirements. All users in a VLAN should have roughly the same traffic flow patterns

End-to-end VLAN follows the 80/20 rule in which 80 percent of user traffic stays within the local workgroup, whereas 20 percent is destined for a remote resource in the campus network (like Internet…).

End-to-end VLANs have the following characteristics:
Users are grouped into a VLAN based on function, not location.
The user belongs to the same VLAN no matter where he plugs his PC into the network (this requires Cisco's VMPS).
End-to-end VLANs are typically used for security reasons or for application or resource requirements.
End-to-end VLANs are difficult to implement and troubleshoot

Local VLANs
The problem with end-to-end VLANs is that they become extremely difficult to maintain as the campus network grows and changes. Because of this, most network administrators of campus environments use local VLANs.
Unlike end-to-end VLANs, local VLANs are very easy to plan and implement. Local VLANs are based on geographic locations by demarcation at a hierarchical boundary (core, distribution, access). Therefore, a local VLAN would never span from an access layer to a core block.

Local VLAN follows the 20/80 rule: only 20 percent of traffic is local, whereas 80 percent is destined to a remote re-source across the core layer

Troubleshooting VLAN Problems

by Shabeeribm

Troubleshooting VLAN Problems

If you're experiencing connectivity problems in a VLAN environment, you should perform the following troubleshooting steps:

Check the status of the interface with the show interfaces command. Use CDP to check connectivity.
Check the duplexing of the connection (auto negotiation is a common problem with the negotiation of the duplexing mode).

Is your router and switch configuration correct? Verify that you've configured your routing protocol and your router's interface. If you're trunking between the router and the switch, verify this configuration.

Have you set up your VLAN configuration correctly? Check to make sure that the appropriate interfaces are associated with the correct VLANs.

Configuring VLAN

by Shabeeribm

To create a VLAN:

Switch# conf t
Switch(config)# vlan 50
Switch(config-vlan)# name sysnet
Switch(config-vlan)# exit

Assigning to an interface:

Switch(config)# int fa 1/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 50
Switch(config-if)# no shut

To delete a VLAN:

Switch(config)# no vlan 50

VLAN Verification

To determine the trunking status of an interface:

# show int fa 1/24 trunk OR # show trunk.

For more detailed switchport information:

# show int fa 1/24 switchport

To determine the physical status of a link:

# show int fa 1/24 status

To see a list of VLANs and their assigned interfaces:

# show vlan brief

To check if an interface is assigned to a specific VLAN:

# show vlan id 100

This command is especially helpful as it displays all ports belonging to the VLAN as well as the MTU of each assigned port and type.To see a complete detailed interface list for all VLANs:

# show vlan

What is QinQ ( 802.1Q tunneling ) ?

by Shabeeribm

802.1Q tunneling

IEEE 802.1Q tunneling can be used to achieve simple layer 2 VPN connectivity between sites by encapsulating one 802.1Q trunk inside another. 802.1Q tunneling also called QinQ

Business customers of service providers often have specific requirements for VLAN IDs and the number of VLANs to be supported. The VLAN ranges required by different customers in the same service-provider network might overlap, and traffic of customers through the infrastructure might be mixed. Assigning a unique range of VLAN IDs to each customer would restrict customer configurations and could easily exceed the VLAN limit (4096) of the IEEE 802.1Q specification.

802.1Q tunneling solves this issues by assigning each customer a single VLAN number, chosen by the service provider. Within each customer VLAN exists a secondary 802.1Q trunk, which is controlled by the customer. Each customer packet traversing the service provider network is tagged twice: the inner-most 802.1Q header contains the customer-chosen VLAN ID, and the outer-most header contains the VLAN ID assigned to the customer by the service provider.

Customer traffic tagged in the normal way with appropriate VLAN IDs comes from an IEEE 802.1Q trunk port on the customer device and into a tunnel port on the service-provider edge switch. The link between the customer device and the edge switch is asymmetric because one end is configured as an IEEE 802.1Q trunk port, and the other end is configured as a tunnel port.

Note: By default, the native VLAN traffic of a dot1q trunk is sent untagged, which cannot be double-tagged in the service provider network. Because of this situation, the native VLAN traffic might not be tunneled correctly. Be sure that the native VLAN traffic is always sent tagged in an asymmetrical link.Also we must verify that all of our switches support the necessary maximum transmission unit (MTU), 1504 bytes before configuring 802.1Q tunneling

These are some ways to solve Native VLAN tagging problem:

•Use the vlan dot1q tag native global configuration command to configure the edge switch so that all packets going out an IEEE 802.1Q trunk, including the native VLAN, are tagged. If the switch is configured to tag native VLAN packets on all IEEE 802.1Q trunks, the switch accepts untagged packets, but sends only tagged packets.

•Ensure that the native VLAN ID on the edge-switch trunk port is not within the customer VLAN range. For example, if the trunk port carries traffic of VLANs 100 to 200, assign the native VLAN a number outside that range.

What is Multi VLAN port ?

by Shabeeribm

What is Multi VLAN port ?

The multi-VLAN port is a special feature which allows switch for configuring a single port for 2 or more vlans. This feature allows users from different VLANs to access a server or router without implementing InterVLAN routing capability. A multi-VLAN port performs normal switching functions in all its assigned VLANs.

multi-VLAN port will not work when a trunk is configured on the switch. Multi-VLAN can’t be used to connect between switches. Multi-VLAN port only used to connect a router or server. The switch automatically transitions to VTP transparent mode when the multi-VLAN port feature is enabled, making the VTP disabled.

The multi-VLAN port feature is supported only on the Catalyst 2900 XL/3500 XL series switches. This feature is not supported on the Catalyst 4000/5000/6000 series or any other Cisco Catalyst switches.

Configuration
Switch(config-if)# switchport mode multi

To assign a multi-VLAN port already in multi mode to a range of VLANs:
Switch(config-if)# switchport multi vlan 15-20

What is the difference between static VLAN and dynamic VLAN?

by Shabeeribm

Static VLAN and dynamic VLAN

Static VLANs are also referred to as port-based VLANs .In static VLAN switch-ports must be manually assigned to a VLAN. Any device connecting to that switch-port(s) becomes a member of that VLAN. The client device is unaware that it belongs to a specific VLAN. Static VLAN is easy to configure.

In static VLAN,as a device enters the network, the device automatically assumes the VLAN of the port. If the user changes ports and needs access to the same VLAN, the network administrator must manually make a port-to-VLAN

In dynamic VLAN devices are automatically assigned into a VLAN based on its MAC address. This allows a client device to remain in the same VLAN, regardless of which switch port the device is attached to. VLAN membership of a user always remains the same even when he/she is moved to another location.

Dynamic VLANs are created through the use of software. With a VLAN Management Policy Server (VMPS), an administrator can assign switch ports to VLANs dynamically based on information such as the source MAC address of the device connected to the port or the username used to log onto that device. As a device enters the network, the switch queries a database for the VLAN membership of the port that device is connected to.

Static VLAN assignment provides a simple way to assign VLAN to a port while Dynamic VLANs allow a great deal of flexibility and mobility for end users but require more administrative overhead.

How to configure Private VLAN

by Shabeeribm

Private VLAN

The private VLAN always has one primary VLAN. Within the primary VLAN you will find the

promiscuous port. In my picture above you can see that there’s a router connected to a

promiscuous port. All other ports are able to communicate with the promiscuous port.

Within the primary VLAN you will encounter one or more secondary VLANs.There are two

types of secondary VLAN. They are

• Community VLAN: All ports within the community VLAN are able to communicate

with each other and the promiscuous port.

• Isolated VLAN: All ports within the isolated VLAN are unable to communicate with

each other but they can communicate with the promiscuous port.

Private VLANs are only locally-significant to the switch - VTP will not pass this information to other switches.Each switch interface in a private VLAN assumes a specific role:

Promiscuous - communicates with the primary VLAN and all secondary VLANs. Gateway devices such as routers and switches should connect to promiscuous ports.

Host – communicates only with promiscuous ports, or ports within the local community VLAN. Host devices connect to host ports.PVLANs thus allow groups of host devices to be segmented within a VLAN,while still allowing those devices to reach external networks via a

promiscuous gateway.

NOTE : Private vlan is configured in VTP Transparent Mode

Private VLAN Configuration

The first step to configuring Private VLANs is to specify the secondary VLANs:

Switch(config)# vlan 100

Switch(config-vlan)# private-vlan community

Switch(config)# vlan 101

Switch(config-vlan)# private-vlan isolated

Next, the primary VLAN must be specified, and the secondary VLANs associated with it:

Switch(config)# vlan 50

Switch(config-vlan)# private-vlan primary

Switch(config-vlan)# private-vlan association 100,101

Secondary VLANs 100 and 101 have been associated with the primary VLAN 50.Next, Host ports must be identified, and associated with a primary and secondary VLAN:

Switch(config)# interface range fa0/5 – 6

Switch(config-if)# switchport private-vlan host

Switch(config-if)# switchport private-vlan host-association 50 101

Interfaces fa0/5 and fa0/6 have been identified as host ports, and associated with primary VLAN 50, and secondary VLAN 101.Finally, promiscuous ports must be identified, and associated with the primary VLAN and all secondary VLANs.

Switch(config)# interface range fa0/20

Switch(config-if)# switchport private-vlan promiscuous

Switch(config-if)# switchport private-vlan mapping 50 100 101

Interface fa0/20 has been identified as a promiscuous port, and associated with primary VLAN 50, and secondary VLANs 100 and 101.

Show Commands

#show interfaces fastEthernet 0/20 switchport

#show vlan private-vlan

#show vlan private-vlan type

Points to Remember

• Devices within a community VLAN can communicate with each other AND the

promiscuous port.

• Devices within an isolated VLAN cannot communicate with each other and can ONLY

communicate with the promiscuous port.

• The promiscuous port can communicate with any other port.

• Secondary VLANs are unable to communicate with other secondary VLANs.

• Private VLANs can be spanned across multiple switches if you use trunks.

VTP explained with Interview Questions

by Shabeeribm

VLAN Trunking Protocol (VTP) is a Cisco proprietary protocol that carries VLAN information to all the switches in a VTP domain.VTP reduces administration in a switched network. When you configure a new VLAN on one VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere.The VTP configuration has a revision number which will increase when you make a change. Every time you make a change on the VTP server this

will be synchronized to the VTP clients

Main points to be remembered

· VTP adds / modifies / deletes vlans under same domain
· For every change occur, the revision number will increase.
· By default all switches are in VTP Server mode
· VTP Client updates own database and forward updates to other clients
· VTP Transparent mode dont update own database but forward updates to other clients
· The latest advertisement will be sent to all VTP clients.
· VTP clients will synchronize themselves with the latest information.
· By default, VTP updates are sent out every 300 seconds, or anytime a change to the database occurs.

VTP Modes

VTP-enabled switches can operate in one of three modes:

• Server : Only VTP Servers can create, modify or delete entries in the shared VLAN database. Servers advertise their VLAN database to all other switches on the network, including other VTP servers. This is the default mode for Cisco Catalyst switches. VTP servers can only advertise VLANs 1 - 1005.

• Client : VTP Clients cannot make modifications to the VLAN database.VTP client updates VTP information having higher revision number in its own database and forward update to other VTP clients

• Transparent : VTP Transparent will forward advertisements but will not synchronize itself. You can create vlans locally though which is impossible on the VTP client.

Transparent switches handle this pass-through differently depending on the VTP version:

• VTP Version 1 – the transparent switch will only pass updates from the same VTP domain.

• VTP Version 2 – the transparent switch will pass updates from any VTP domain.

NOTE : As a best practice, a new switch should be configured as a VTP client in the VTP domain, and have its configuration revision number must set back to zero before being installed into a production network,Because VTP has a huge security risk…the problem with VTP is that a VTP server is also a VTP Client and a VTP client can overwrite a VTP server if the revision number is higher

REMEMBER: A VTP client can update other clients and VTP servers in the VTP domain, if its revision number is higher.

You can reset revision number by

• Changing the domain-name will reset the revision number.

• Deleting the vlan.dat file on your flash memory will reset the revision number

NOTE : There’s a difference between VTP Transparent mode and Server/Client mode. In VTP transparent mode all vlan information can be seen at "running-config" mode .But VTP Server and Client mode store their information in the VLAN database (vlan.dat on your flash memory).

VTP Updates

By default revision number will be zero.Every change to the VLAN database increments the configuration revision number by 1.A VTP switch will only accept or synchronize an update if the revision number is higher than that of the currently installed VLAN database. Updates with a lower revision number are ignored.

VTP utilizes three message types:

• Summary Advertisement – sent out every 300 seconds, informing all VTP switches of the current configuration revision number.

• Subset Advertisement – sent out when there is a change to the VLAN database. The subset advertisement actually contains the updated VLAN database.

• Advertisement Request – sent out when a switch requires the most current copy of the VLAN database. A switch that is newly joined to the VTP domain will send out an Advertisement Request.

Configuring VTP

To configure the VTP domain (the domain name is case sensitive):

Switch(config)# vtp domain <Name>

To configure the VTP mode:

Switch(config)# vtp mode <server /Client / Transparent >

The VTP domain can be further secured using a password:

Switch(config)# vtp password <PASSWORD>

All switches participating in the VTP domain must be configured with the same password. The password will be hashed into a 16-byte MD5 value.

By default, a Catalyst switch uses VTP version 1. VTP Version 1 and 2 are not compatible

To enable VTP version 2 globally on all switches:

Switch(config)# vtp version 2

To view status information about VTP:

Switch# show vtp status

VTP Pruning

VTP pruning is a process of preventing unnecessary VLAN broadcast or multicast traffic throughout the switching infrastructure.With VTP pruning, traffic is only sent out the necessary VLAN trunk ports where those VLANs exist.For example,Consider 3 switches called switch A,B and C.

If A and B have vlan 10,20 and 30 and Switch C have vlan 10 and 20.By default all vlan information is sent along switches A,B and C.Once we enable VTP Pruning vlan 30 information wont be send to Switch C because vlan 30 doesnt exist there

VTP pruning is disabled by default on Catalyst IOS switches. If applied on a VTP server, the following command will enable VTP pruning globally on all switches:

Switch(config)# vtp pruning

On trunk ports, it is possible to specify which VLANs are pruning eligible:

Switch(config)# interface fa0/24Switch(config-if)# switchport trunk pruning vlan add 2-50Switch(config-if)# switchport trunk pruning vlan remove 50-100

OR like this

Switch(config)# interface fa0/24Switch(config-if)# switchport trunk pruning vlan allSwitch(config-if)# switchport trunk pruning vlan except 2-100

VLAN 1 is never eligible for pruning. The system VLANs 1002-1005 are also pruning-ineligible.

Troubelshooting commands:

#show vtp status

#show vlan

#debug sw-vlan vtp events

INTERVIEW QUESTIONS

what are different Vlan modes ?
What happens to interfaces when you delete a VLAN?
What is the difference between VTP Transparent and VTP Client mode ?
Which is the default mode of VTP ?
what is VTP Pruning ?
What are two benefits of using VTP in a switching environment?
Which VTP mode is capable of creating only local VLANs and does not synchronize with other switches in the VTP domain?

Objective Type Questions

VLAN explained with Interview Questions

by Shabeeribm

We know switch having one broadcast domain and multiple collision domain.In normal case when a switch sends a broadcast it will reach all ports.But in some cases we have to restrict that behavior of switches.For that we use Virtual LANs (or VLANs).

VLAN's separate a Layer-2 switch into multiple broadcast domains. Each VLAN is its own individual broadcast domain.Individual ports or groups of ports can be assigned to a specific VLAN. Only ports belonging to the same VLAN can freely communicate to each other.A router or layer 3 switch is needed for Inter-VLAN Communication.Broadcasts from one VLAN will never be sent out ports belonging to another VLAN. By default on Cisco Catalyst switches, all interfaces belong to VLAN 1. VLAN 1 is considered the Management VLAN (by default).

What are the advantages of using vlans?

• A VLAN is a single broadcast domain which means that if a user in the engineering VLAN sends a broadcast frame only users in the same VLAN will receive it.

• Users are only able to communicate within the same VLAN (unless you use a router).

• Users don’t have to be grouped physically together, as you can see we have users in the Engineering vlan sitting on the 1st, 2nd and 3rd floor.

Terminologies associated with VLAN's

Trunking : Carrying multiple VLANs over the same physical connection.We must configure a trunk link between two switches.Only trunk links are capable of carrying multiple VLAN information

Native VLAN :By default, frames in this VLAN are untagged when sent across a trunk. VLAN 1 is called native VLAN (By default)

Access VLAN : The VLAN to which an access port is assigned

Dynamic Trunking Protocol (DTP) :Can be used to automatically establish trunks between capable ports (insecure method!)

Switched Virtual Interface (SVI) : A virtual interface which provides a routed gateway into and out of a VLAN

Router on Stick : Method used for communicating Inter-VLAN's using a router

There are two trunking protocols we can use:

• IEEE 802.1Q [dot1Q] : An open standard that is supported on switches from many vendors and most NICs.

• Cisco ISL (Inter-Switch Link): An old Cisco proprietary protocol that is only supported on some Cisco switches.

IEEE 802.1Q	ISL (Inter-Switch Link)
Open Standard	Cisco Proprietary
Native VLAN is not tagged	Native Vlan is tagged
Tags Ethernet Frame	Encapsulate Ethernet Frame
Maximum VLANs : 4094	Maximum VLANs 1000
Header Size : 4 bytes	Header Size : 26 bytes

Different Switch Port Modes

Trunk : Forms an unconditional trunk

dynamic desirable : Attempts to negotiate a trunk with the far end

dynamic auto : Forms a trunk only if requested by the far end

access : Will never form a trunk

Let me give you an overview of the different switchport modes and the result:

Note : Older switches are dynamic desirable by default and modern switches are dynamic auto by default.Its better to manually configure trunk and give non-negociate command.The negotiation of the switchport status by using dynamic auto or dynamic desirable is called DTP (Dynamic Trunking Protocol). You can disable it completely by using the switchport nonegotiate command

VLAN information is not saved in the running-config or startup-config but in a separate file called vlan.dat on your flash memory. If you want to delete the VLAN information you should delete this file by typing delete flash:vlan.dat.

VLAN Creation

Switch(config)# vlan 100

Switch(config-vlan)# name Engineering

Switch(config-vlan)#exit

Adding interface to VLAN

Switch(config)#interface fastethernet 0/1

Switch(config-if)#switchport mode access

Switch(config-if)# switchport nonegotiate

Switch(config-if)#switchport access vlan 3

Configuring Trunk Links

To manually configure a trunk port, for either ISL or 802.1Q tagging:

Switch(config)# interface fa0/24

Switch(config-if)# switchport trunk encapsulation< isl / dot1q >

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport nonegotiate

To change Native Vlan

Switch(config)#interface fa0/14

Switch(config-if)#switchport trunk native vlan 100

For security reasons it might be a good idea not to allow all VLANs on your trunk link. We can change this by using the switchport trunk allowed vlan command.

Switch(config)# interface fa0/24

Switch(config-if)# switchport trunk allowed vlan remove 50-100

Switch(config-if)# switchport trunk allowed vlan add 60-65

The first switchport command will prevent the trunk port from passing traffic from VLANs 50-100. The second switchport command will re-allow the trunk port to pass traffic from VLANs 60-65.

SVI Configuration

Switch(config)# interface vlan100

Switch(config-if)# ip address 192.168.100.1 255.255.255.0

Router on a Stick Configuration

STEP 1 : Switch configuration

SW1# configure terminal

SW1(config)# interface fa 0/1

SW1(config-if)# switchport trunk encapsulation dot1q

SW1(config-if)# switchport mode trunk

The above steps complete the switch-side configuration.

STEP 2 - Router Configuration

We need to follow a similar configuration for our router to enable communication with our switch and allow all VLAN traffic to pass through and route as necessary.

R1# configure terminal

R1(config)# interface Fa 0/2

R1(config-if)# no ip address

R1(config-if)# no shutdown

R1(config-if)# interface Fa 0/2.1

R1(config-subif)# encapsulation dot1q 1 native

R1(config-subif)# ip address 192.168.0.1 255.255.255.0

R1(config-subif)# interface Fa 0/2.2

R1(config-subif)# encapsulation dot1q 2

R1(config-subif)# ip address 192.168.2.1 255.255.255.0

R1(config-subif)#exit

Show Commands

show vlan

show interface fa 0/24 switchport]

show interface trunk

show interface fa 0/24 trunk

INTERVIEW QUESTIONS

Which switching technology reduces the size of a broadcast domain?
Which protocols are used to configure trunking on a switch?
What is SVI ?
what is meant by "router on stick" ?
which is the default mode in switch ports ?
Difference between 802.1Q and ISL ?
Which are the two trunking protocols ?
Which Protocol encapsulate Etherframes ?
Which is the Vlan not tagged by 802.1Q ?
How to delete vlan information from switch ?
Difference between access and trunk mode ?
Difference between dynamic auto and dynamic desirable ?
what is the use of nonegociate command in switch ?
Explain different switch port modes ?
what is DTP ?
Can we see trunk interfaces in show vlan command ?
which is the command used to see trunk interfaces ?
what is the maximum number of vlans permitted in 802.1Q and ISL
what is the header size of 802.1Q ?

Objective Type Questions :

Sysnet Notes

Router on a Stick and SVI configuration

Vlan Interview Questions and Answers

CCNP : Configuring VLAN ACLs

What is VLAN Hopping

Dynamic Trunking Protocol (DTP)

Difference between End-to-end VLANs and Local VLANs

Troubleshooting VLAN Problems

Configuring VLAN

What is QinQ ( 802.1Q tunneling ) ?

What is Multi VLAN port ?

What is the difference between static VLAN and dynamic VLAN?

How to configure Private VLAN

VTP explained with Interview Questions

VLAN explained with Interview Questions

Popular Posts

Labels

Total Pageviews

Related articles

Related articles

Related articles

Did You Enjoy this Article ?

Related articles

Related articles

Did You Enjoy this Article ?

Related articles

Related articles

Did You Enjoy this Article ?

Popular Posts

Labels

Total Pageviews