ICND2 CH1 - Virtual LANs Flashcards
Native VLAN - why must all switches agree on the native VLAN ID?
802.1Q header not added to native VLAN (default VLAN ID 1), untagged packets received on trunk are assigned to native VLAN, that’s why all switches must agree (have set) the same native VLAN.
How are VLANs and subnets different?
VLAN - Layer 2 concept.
Subnet - Layer 3 concept.
Most common reasons for using VLANs (five)
- Flexibility, not limited by physical location.
- Smaller LANs (broadcast domains), reduce overhead to each host.
- Reduce workload for Spanning Tree Protocol (STP) - limit VLAN to single access switch.
- Security, keep hosts with sensitive data on separate VLAN.
- PC <-> Phone <-> Switch: separate traffic.
Can Cisco switches disable VTP? (VLAN Trunking Protocol)
No.
Closest option: user transparent mode - switch ignores VTP but forwards VTP messages to other switches.
What determines if a VTP update will cause a switch in server or client mode to update it’s VTP database?
If the VTP update has a higher database configuration revision number (each update +1).
What ports are used to send VTP messages sent to other switches?
VTP messages are sent out on all trunks!
Process is called synchronization.
Three requirements for VTP to work between two switches.
- VLAN trunk (ISL or 802.1Q)
- VTP domain name must match (case sensitive)
- VTP password must match (case sensitive), if configured!
Where is VLAN configuration actually stored on a switch?
In a file called vlan.dat, stored in FLASH MEMORY!
Switches in transparent mode store VLAN configuration in both running-config and vlan.dat.
What is the command to remove VLAN and VTP configuration from a switch?
delete flash:vlan.dat
VTP: Server | Client | Transparent
Which only sends VTP messages out ISL or 802.1Q trunks?
Server: Yes
Client: Yes
Transparent: Yes
VTP: Server | Client | Transparent
Which supports CLI configuration of VLANs?
Server: Yes
Client: No
Transparent: Yes (because it’s autonomous, can have independent VLANs)
VTP: Server | Client | Transparent
Which can use normal-range VLANs (1-1005)?
Server: Yes
Client: Yes
Transparent: Yes
VTP: Server | Client | Transparent
Which can use extended-range VLANs (1006-4095)
Server: No
Client: No
Transparent: Yes
VTP: Server | Client | Transparent
Which synchronizes (updates) its own config database when receiving VTP messages with a higher revision number?
Server: Yes
Client: Yes
Transparent: No
VTP: Server | Client | Transparent
Which creates and sends periodic VTP updates every 5 minutes?
Server: Yes
Client: Yes
Transparent: No
VTP: Server | Client | Transparent
Which does not process received VTP updates but does forward received VTP updates out other trunks?
Server: No
Client: No
Transparent: Yes
VTP: Server | Client | Transparent
Which places VLAN ID, VLAN name, and VTP configuration into the running-config file?
Server: No
Client: No
Transparent: Yes
VTP: Server | Client | Transparent
Which places the VLAN ID, VLAN name, and VTP configuration into the vlan.dat file in flash?
Server: Yes
Client: Yes
Transparent: Yes
Steps to configure a new VLAN (two):
- ! create VLAN and move into VLAN configuration mode
(config) # vlan vlan-id - ! optional, assign name to VLAN, default VLAN####
(config-vlan)# name name
Steps to configure a VLAN for each access interface (three):
- ! move into interface configuration mode for desired interface
(config) # interface fa0/1 - ! specify the VLAN number associated with this interface
(config-if)# switchport access vlan id-number
- ! optional, disable trunking on interface, ensuring access interface
(config-if)# switchport mode access
Default VTP configuration for a switch (four settings):
- VTP server mode.
- No VTP domain name.
- VLAN 1 and 1002-1005 automatically configured, can’t be deleted.
- All access interfaces assigned to VLAN 1.
What does the optional interface subcommand switchport mode access do?
Force access mode ONLY.
Otherwise, interface could negociate to use trunking, becoming a trunk.
Explain trunking administrative mode options with the interface subcommand
switchport mode
access
trunk
dynamic desirable
dynamic auto
switchport mode access <- prevent trunking, force access mode
switchport mode trunk <- force trunking
switchport mode dynamic desirable <- initiate and respond to negotiation messages, establish trunk
switchport mode dynamic auto <- passively wait and respond to negotiation messages, establish trunk
Describe the terms Administrative and Operational as it referes to switches.
Administrative - referes to what is configured.
Operational - refers to what is currently happening.
What VLAN IDs allowed by default on a trunk port?
1-4094
212 = 4096, VLAN ID field has 12 bits, VLAN ID 0 and 4095 reserved.
What FOUR reasons exist that prevent a particular VLAN’s traffic from crossing a trunk?
- VLAN not in trunk’s allowed VLAN list.
- VLAN does not exist or not active.
- VLAN automatically pruned by VTP.
- VLAN STP instance blocked trunk.
Cisco recommendations for how to protect unused switch ports (three).
- shutdown interface (administratively disable)
- Prevent trunking negotiation (use switchport nonegociate or switchport mode access)
- Assign port to unused VLAN (parking lot VLAN)
Note: Shutting down interface eliminates security issue but the other two tasks prevent any immediate problems if someone enables interface with no shutdown command.
What is Cisco’s recommendation for trunk negotiation on all in-use access interfaces?
Disable trunk negociation on access interfaces.
Use switchport nonegociate interface subcommand.
Note: Thinking is that an attacker could disconnect a ligitimate user’s computer from RJ-45 port and try trunk negociation with attacker’s PC.
What can all the switches in the same VTP domain learn from each other?
VLAN configuration information.
Steps to configure VTP on a switch (six).
- (config)# vtp mode {server | client}
- (config)# vtp domain ***domain-name ** * ! case-sensitive
- (config)# vtp password password-value ! (optional) case-sensitive
- (config)# vtp prunning ! (optional)
- **(config)# vtp version 2 ** ! (optional)
- Bring up trunks between the switches.
Two commands to verify VTP configuration since these settings are only stored in vlan.dat file in flash when in server and client mode:
show vtp status
show vlan
NOTE: Any analysis of VTP and VLANs on Cisco switches depends on these two commands.
What VLAN ID is used to send VTP and CDP messages on trunks?
VLAN 1
