Switching Flashcards
Features of access layer switches
Port security VLANs Fast/gigabit Ethernet PoE Link aggregation QoS
Features of distribution layer and core switches
Layer 3 support High forwarding rate Gigabit/10 gigabit Ethernet Redundant components Security policies/ACLs Link aggregation QoS
5 basic LAN switch functions
Learning Aging Flooding Selective forwarding Filtering
Data VLAN
Configured to carry only user-generated traffic, ensuring that voice and management traffic is separated from data traffic
Default VLAN
All the ports on a switch are members of the default VLAN when the switch is reset to defaults. The default VLAN for Cisco is VLAN 1.
It is best practice to restrict VLAN 1 to serve as a conduit only for layer 2 control traffic (CDP, VTP, etc.) and no other traffic
Black hole VLAN
Security best practice is to define a black hole VLAN to be a dummy VLAN distinct from all other VLANs defined in the LAN. All unused switch ports are assigned to the black hole VLAN
management VLAN
a VLAN defined by the network admin as a means to access the management capabilities of the switch
voice VLAN
separates voice traffic from data traffic
how are VLANs identified?
IEEE 802.1q frame tagging
VTP
cisco’s VLAN trunking protol
-layer 2 messaging protocol that maintains VLAN config consistency by managing the additions, deletions, and name changes of VLANs across networks
-VTP domain boundaries are by created by routers or layer 3 switches
3 VTP device modes
Server-where VLANs are created, deleted, or renamed and changes advertised
client-receives config from server, can’t create its own
transparent-doesn’t participate, simply forwards VTP messages
STP
Spanning Tree Protocol
IEEE 802.1D
creates a tree that ensures there is only one one to each network segment at any one time.
If any segment experiences a disruption in connectivity, STP rebuilds a new tree by activating the previously inactive, but redundant, path.
BPDU
bridge protocol data unit
-message format used by STP
BID
bridge ID
unique to each switch and contains a priority
root bridge
bridge with lowest priority number
troubleshooting STP
1) determine root switch
2) for each non root switch, determine its root port and cost to reach the root switch thru that port
3) for each segment, determine the designated port and the cost advertised by the DB of that segment
configure VLAN in global config mode
VLAN vlan-id name vlan-name
apply to interface
common VLAN errors
- native VLAN mismatches
- trunk mode mismatches
- VLANs and IP Subnets
- allowed VLANs on trunks
VTP troubleshooting step 1
- confirm switch names, topology, and VTP modes
- identify sets of 2 neighbor switches that should be either VTP clients or servers or VLAN databases differ
- on those switches verify trunk between them, same VTP domain, same VTP password
- fix configuration issues
reasons for VLANs
- grouping users by department instead of physical location
- segmenting devices into smaller LANs to reduce processing overhead for all devices on the LAN
- reducing the workload of STP by limiting a VLAN to a single switch
- enforcing better security by isolating sensitive data to separate VLANs
- separating IP voice form IP data
data VLAN
configure to carry only user-generated traffic, ensuring that voice and management traffic separated from data traffic
default VLAN
all the ports on a switch are members of the default VLAN when the switch is reset to defaults
the default VLAN for cisco is VLAN 1.
It is best practice to restrict VLAN 1 to serve as a conduit only for layer 2 control traffic (CDP, VTP, etc.) and no other traffic
black hole VLAN
security best practice is to define a black hole VLAN to be a dummy VLAN distinct from all other VLANs established in the LAN.
all unused switch ports are assigned to the black VLAN
How often are VTP advertisements sent?
5 mins