Purpose: The purpose of this chapter is to describe VLAN operations on the Catalyst switches. Timing: This module should take about two hours to present. Contents: Basic VLAN operations. VTP operations. Cat1900 VLAN configurations. Lab first part - VLAN configurations. Lab second part - STP.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: Configure a VLAN Configure VLAN Trunking Protocol (VTP) Configure a switch for trunking Verify VLAN connectivity Verify spanning-tree operations Slide 1 of 1 Purpose: Emphasize:

A VLAN = A broadcast domain = Logical network (subnet) VLAN Overview Segmentation Flexibility Security 3rd floor 2nd floor Slide 1 of 1 Purpose: Emphasize: A VLAN is a broadcast domain. Note: In order to have inter-vlan communications, a router is required. 1st floor SALES HR ENG A VLAN = A broadcast domain = Logical network (subnet)

VLAN Operations Each logical VLAN is like a separate physical bridge Switch A Green VLAN Black Red Slide 1 of 3 Purpose: Emphasize: Each port on the switch can be assigned to a VLAN. By default, all ports are in VLAN 1, a factory default VLAN. Each logical VLAN is like a separate physical bridge

VLAN Operations Each logical VLAN is like a separate physical bridge Switch A Green VLAN Black Red Switch B Slide 2 of 3 Purpose: Emphasize: To allow VLANs to span across multiple switches, the connection between the switches must belong to mulitple VLANs. Red VLAN Black VLAN Green VLAN Each logical VLAN is like a separate physical bridge VLANs can span across multiple switches

VLAN Operations Each logical VLAN is like a separate physical bridge Switch A Green VLAN Black Red Switch B Trunk Fast Ethernet Slide 3 of 3 Purpose: Emphasize: A trunk is used to connect two switches together. A trunk carries traffic for multiple VLANs. Only the fastethernet ports on the 1900 can be configured as trunk port. Trunking is off by default on the 1900 fastethernet ports (fa 0/26 and fa 0/27). Note: The 1900 supports DISL. At the time of the beta, the core switch (2900xl) doesn’t support DISL. Red VLAN Black VLAN Green VLAN Each logical VLAN is like a separate physical bridge VLANs can span across multiple switches Trunks carries traffic for multiple VLANs

VLAN Membership Modes Static VLAN Dynamic VLAN Port e0/4 Port e0/9 Trunk Port e0/4 Port e0/9 VLAN5 Slide 1 of 1 Purpose: Emphasize: Note: Once a port has been assigned to a VLAN, it can not send or receive traffic from devices in another VLAN without the intervention of a layer 3 device like a router. The 1900 can’t be configure as the VMPS. A CiscoWorks 2000 or CWSI management station or a Cat 5000 switch can be configured as the VMPS. In the future, dynamic VLANs may also offer membership based on other criteria such as protocol or application. Dynamic VLANs are covered in the Managing Cisco Switched Internetworks class. VLAN10 VMPS 1111.1111.1111 = vlan 10 MAC = 1111.1111.1111

ISL Tagging ISL trunks enable VLANs across a backbone Performed with ASIC Not intrusive to client stations, client does not see the ISL header Effective between switches, routers and switches, switches and servers with ISL network interface cards VLAN Tag added by incoming port Inter-Switch Link carries VLAN identifier Slide 1 of 1 Purpose: Emphasize: Note: The 1900 only supports ISL trunking. ISL is Cisco Proprietary. 802.1Q is an IEEE standard. Other trunk types: LANE (VLANSs over ATM) 802.10 (FDDI trunk) VLAN Tag stripped by forwarding port

Encapsulated Ethernet frame ISL Encapsulation ISL Header 26 bytes Encapsulated Ethernet frame CRC 4 bytes DA Type User SA LEN AAAA03 HSA VLAN BPDU BPDU INDEX RES VLAN BPDU Slide 1 of 1 Purpose: Emphasize: Note: Since ISL technology is implemented in ASICs, frames are tagged at wire speed. The number of VLANs supported by a switch depends on the switch hardware. The Catalyst 1900en supports 64 active VLANs with an instance of STP per VLAN. PVST = Per VLAN Spanning Tree. PVST is a Cisco proprietary implementation. It requires Cisco ISL encapsulation in order to work. Frames encapsulated with ISL header and CRC Support for many VLANs (1024) VLAN field BPDU bit

VLAN Trunking Protocol (VTP) A messaging system that advertises VLAN configuration information Maintains VLAN configuration consistency throughout a common administrative domain VTP sends advertisements on trunk ports only Support mixed media trunks (Fast Ethernet, FDDI, ATM) VTP Domain “ICND” 3.Sync to the latest vlan information Slide 1 of 1 Purpose: Emphasize: Notes: VTP is a Cisco proprietray feature. VTP is a Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP minimizes misconfigurations and configuration inconsistencies that can cause several problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations. A VTP domain (also called a VLAN management domain) is one switch or several interconnected switches sharing the same VTP domain. A switch is configured to be in only one VTP domain. You make global VLAN configuration changes for the domain by using the Cisco IOS command-line interface (CLI), Cisco Visual Switch Manager Software, or Simple Network Management Protocol (SNMP). By default, a 1900 switch is in the no-management-domain state until it receives an advertisement for a domain over a trunk link or you configure a management domain. The default VTP mode is server mode, but VLANs are not propagated over the network until a management domain name is specified or learned. If the switch receives a VTP advertisement over a trunk link, it inherits the management domain name and configuration revision number. The switch then ignores advertisements with a different management domain name or an earlier configuration revision number. When you make a change to the VLAN configuration on a VTP server, the change is propagated to all switches in the VTP domain. VTP advertisements are transmitted out all trunk connections, including Inter-Switch Link (ISL), IEEE 802.1Q, IEEE 802.10, and ATM LAN Emulation (LANE). If you configure a switch from VTP transparent mode, you can create and modify VLANs, but the changes are not transmitted to other switches in the domain, and they affect only the individual switch. 2 1.“new vlan added”

VTP Modes Server Client Transparent Create vlans Modify vlans Delete vlans Sends/forwards advertisements Synchronize Saved in NVRAM Server Sends/forwards advertisements Synchronize Not saved in NVRAM Slide 1 of 1 Purpose: Emphasize: Default VTP mode on the Catalyst switches is Server. Be careful when adding new switches into an existing network. This is covered in more detail later. Create vlans Modify vlans Delete vlans Forwards advertisements Does not synchronize Saved in NVRAM Client Transparent

How VTP Works VTP advertisements are sent as multicast frames VTP servers and clients synchronized to latest revision number VTP advertisement are sent every five minutes or when there is a change Slide 1 of 2 Purpose: Emphasize: Notes: VTP advertisements are sent on factory-default VLAN based on the media type. Each advertisement starts as configuration revision number 0. When changes are made, the configuration revision number increments (n+1). Routers ignore VTP packets. There are two types of advertisements; requests from clients that want to learn at boot up and response from servers. There are three types of messages; summary advertisements sent every 300 seconds on VLAN 1, subset advertisements with information about VLANs, and advertisement requests from clients where the server responds with summary and subset advertisements

How VTP Works VTP advertisements are sent as multicast frames VTP servers and clients synchronized to latest revision number VTP advertisement are sent every five minutes or when there is a change 1.Add new VLAN 2.Rev 3 --> Rev 4 Slide 2 of 2 Purpose: Emphasize: The latest revision number is what the switches will synchronize to. 3 Server 3 4.Rev 3 --> Rev 4 5.Sync new vlan info 4.Rev 3 --> Rev 4 5.Sync new vlan info Client Client

VTP Pruning Increases available bandwidth by reducing unnecessary flooded traffic Example: Station A sends broadcast, broadcast is only flooded toward any switch with ports assigned to the red VLAN Port 2 B Switch 4 Flooded traffic is pruned Switch 2 Slide 1 of 1 Purpose: Emphasize: VTP prunning provides optimized flooding. Without VTP prunning, station A’s broadcast will be flooded to all switches whether they have any port in the red vlan or not. Note: VLAN 1 can’t be prunned. STP, CDP, VTP updates are sent on VLAN1. All switches in the switched network must support prunning or prunning will be disabled. Each trunk port maintains a state variable per vlan indicating if the switch has any port assigned to a particular vlan or not. Red VLAN Switch 5 Port 1 A Switch 6 Switch 3 Switch 1

VLAN Configuration Guidelines Maximum number of VLANs is switch-dependent Catalyst 1900 supports 64 VLANs with a separate spanning tree per VLAN VLAN1 is One of the factory default VLANs CDP and VTP advertisements are sent on VLAN1 Catalyst 1900 IP address is in the VLAN1 broadcast domain Must be in VTP server or transparent mode to create, add, or delete VLANs Slide 1 of 1 Purpose: Emphasize: Note: In the ICND lab, All the switches and routers are in VLAN1. The core server and the core router are in multiple VLANs. Each workgroup PC is on an unique VLAN.

VLAN Configuration Steps Enable VTP (optional) Enable trunking Create VLANs Assign VLAN to ports Slide 1 of 1 Purpose: Show the four basic steps for configuring VLANs. Emphasize:

VTP Configuration Guidelines VTP domain name VTP mode (server/client/transparent)—VTP server mode is the default VTP pruning VTP password VTP trap Slide 1 of 1 Purpose: Emphasize: Notes: All switches in a VTP domain must run the same VTP version. The password entered with a domain name should be the same for all switches in the domain. If you configure a VTP password, the management domain will not function properly if you do not assign the management domain password to each switch in the domain. A VTP version 2-capable switch can operate in the same VTP domain as a switch running VTP version 1 provided version 2 is disabled on the version 2-capable switch (version 2 is disabled by default). Do not enable VTP version 2 on a switch unless all of the switches in the same VTP domain are version 2-capable. When you enable version 2 on a switch, all of the version 2-capable switches in the domain must have version 2 enabled. If there is a version 1-only switch, it will not exchange VTP information with switches with version 2 enabled. If there are token ring networks in your environment, you must enable VTP version 2 for Token Ring VLAN switching to function properly. Enabling or disabling VTP pruning on a VTP server enables or disables VTP pruning for the entire management domain. In the lab, all the switches are set to VTP transparent mode. Use caution when adding a new switch into an existing domain. A new switch should be added in client mode to prevent the new switch from propagating incorrect VLANs information Use the delete vtp command to reset the VTP revision number

Creating a VTP Domain wg_sw_a(config)# vtp [server | transparent] [domain domain-name] [trap {enable | disable}] [password password] [pruning {enable | disable} Slide 1 of 2 Purpose: Emphasize:

Creating a VTP Domain wg_sw_a(config)# wg_sw_a#conf terminal vtp [server | transparent] [domain domain-name] [trap {enable | disable}] [password password] [pruning {enable | disable} wg_sw_a#conf terminal Enter configuration commands, one per line. End with CNTL/Z wg_sw_a(config)#vtp transparent wg_sw_a(config)#vtp domain switchlab Slide 2 of 2 Purpose: Emphasize: Note: The two commands shown in the slide can also be combined into one command: “vtp domain switchlab transparent”

Verifying VTP Configurations wg_sw_a#show vtp Slide 1 of 2 Purpose: Emphasize:

Verifying VTP Configurations wg_sw_a#show vtp wg_sw_a#show vtp VTP version: 1 Configuration revision: 4 Maximum VLANs supported locally: 1005 Number of existing VLANs: 6 VTP domain name : switchlab VTP password : VTP operating mode : Transparent VTP pruning mode : Enabled VTP traps generation : Enabled Configuration last modified by: 10.1.1.40 at 00-00-0000 00:00:00 Slide 2 of 2 Purpose: Emphasize: Note: In the slide, the VLAN database was last modified locally. The IP address of wg_sw_a is 10.1.1.40. In the lab, the 1900s are running version 8.01.01, prunning was disabled by default. In the documentation, prunning is suppose to be enabled by default.

trunk [on | off | desirable | auto | nonegotiate] Defining a Trunk wg_sw_a(config-if)# trunk [on | off | desirable | auto | nonegotiate] On = Set trunk on and negotiate with other side Off = Set trunk off and negotiate with other side Desirable = Negotiate with other side. Trunk on if other side is on, desirable, or auto Auto = Will be a trunk only if the other side is on or desirable Non-negotiate = Set trunk on and will not negotiate Slide 1 of 2 Purpose: Emphasize: The 1900 supports DISL. Note: At the time of the beta, the core switch (2900xl) does not support DISL. If trunking is on at one end, and off at the other end, the link will be down.

Defining a Trunk wg_sw_a(config-if)# First trunk port(Port A) trunk [on | off | desirable | auto | nonegotiate] On = Set trunk on and negotiate with other side Off = Set trunk off and negotiate with other side Desirable = Negotiate with other side. Trunk on if other side is on, desirable, or auto Auto = Will be a trunk only if the other side is on or desirable Non-negotiate = Set trunk on and will not negotiate Slide 2 of 2 Purpose: Emphasize: Note: wg_sw_a#conf terminal Enter configuration commands, one per line. End with CNTL/Z wg_sw_a(config)#interface f0/26 wg_sw_a(config-if)#trunk on First trunk port(Port A)

Verifying a Trunk wg_sw_a#show trunk [A | B] Slide 1 of 2 Purpose: Emphasize: Trunk A = fasthethernet 0/26 Trunk B = fastetherent 0/27

Verifying a Trunk wg_sw_a#show trunk [A | B] wg_sw_a#show trunk a DISL state: On, Trunking: On, Encapsulation type: ISL Slide 2 of 2 Purpose: Emphasize: Note: The Cat 1900,at the time of the beta, only supports ISL trunking. It does not support 802.1Q trunking.

vlan vlan# [name vlan-name] Adding a VLAN wg_sw_a(config)# vlan vlan# [name vlan-name] Slide 1 of 2 Purpose: Emphasize: Each VLAN has a unique, four-digit number that can be from 1 to 1001. To add a VLAN to the VLAN database, the minimum parameter required is the VLAN number.

vlan vlan# [name vlan-name] Adding a VLAN wg_sw_a(config)# vlan vlan# [name vlan-name] wg_sw_a#conf terminal Enter configuration commands, one per line. End with CNTL/Z wg_sw_a(config)#vlan 9 name switchlab2 Slide 2 of 2 Purpose: Emphasize:

wg_sw_a#show vlan [vlan#] Verifying a VLAN wg_sw_a#show vlan [vlan#] Slide 1 of 2 Purpose: Emphasize:

wg_sw_a#show vlan [vlan#] Verifying a VLAN wg_sw_a#show vlan [vlan#] wg_sw_a#sh vlan 9 VLAN Name Status Ports ------------------------------------------------- 9 switchlab2 Enabled VLAN Type SAID MTU Parent RingNo BridgeNo Stp Trans1 Trans2 ------------------------------------------------------------------------------------------------------- 9 Ethernet 100009 1500 0 1 1 Unkn 0 0 -------------------------------------------------------------------------------------------------------- Slide 2 of 2 Purpose: Emphasize: Note: Type: Default is ethernet. (other types are FDDI and Token Ring) SAID: Is used for FDDI trunking. MTU: Default is 1500 for ethernet vlan. STP: The 1900 only supports 802.1d STP. It does not support DEC or IBM STP. Routers support all three STP standards. Other parameters: Used for Token Ring or FDDI VLANs.

vlan vlan# name vlan-name Modifying a VLAN Name wg_sw_a(config)# vlan vlan# name vlan-name wg_sw_a#conf terminal Enter configuration commands, one per line. End with CNTL/Z wg_sw_a(config)#vlan 9 name switchlab90 Slide 1 of 1 Purpose: Emphasize: Note: The output shows that there are currently no ports assigned to VLAN 9. wg_sw_a#show vlan 9 VLAN Name Status Ports ------------------------------------------------ 9 switchlab90 Enabled

Assigning Switch Ports to a VLAN wg_sw_a(config-if)# vlan-membership {static {vlan#} | dynamic} Slide 1 of 2 Purpose: Emphasize: By default, all ports are in VLAN 1.

Assigning Switch Ports to a VLAN wg_sw_a(config-if)# vlan-membership {static {vlan#} | dynamic} wg_sw_a#conf terminal Enter configuration commands, one per line. End with CNTL/Z wg_sw_a(config)#interface ethernet 0/8 wg_sw_a(config-if)#vlan-membership static 9 Slide 2 of 2 Purpose: Emphasize: Note: In the lab, we will only be configuring static VLAN membership.

Verifying VLAN Membership wg_sw_a#show vlan-membership Slide 1 of 2 Purpose: Emphasize:

Verifying VLAN Membership wg_sw_a#show vlan-membership wg_sw_a#show vlan-membership Port VLAN Membership Type Port VLAN Membership Type -------------------------------------------- ----------------------------------------- 1 5 Static 13 1 Static 2 1 Static 14 1 Static 3 1 Static 15 1 Static 4 1 Static 16 1 Static 5 1 Static 17 1 Static 6 1 Static 18 1 Static 7 1 Static 19 1 Static 8 9 Static 20 1 Static Slide 2 of 2 Purpose: Emphasize: Port 1 = e0/1, ……. AUI = e0/25, A = fa 0/26, B = fa 0/27 Note: port 1=e0/1, port 2=e0/2 .....

Verifying Spanning Tree wg_sw_a#show spantree {vlan number} Slide 1 of 2 Purpose: Emphasize: This command displays all instances of spanning-tree that are currently running. If you specify a particular vlan, the system just display the spanning-tree operating parameters for the specified VLAN. Spanning tree is enabled by default on all VLANs. Use the following global configuration command to disable Spanning tree for a VLAN: wg_sw_a(config)#no spantree 2 wg_sw_a#sh span 2 Error: STP is not enabled for VLAN 2 Note: The command syntax on the 2900xl is a little different: “show spanning-tree vlan {vlan number}”. One of the lab procedure requires the students to telnet to the core switches (2900xl) to examine the STP status.

Verifying Spanning Tree wg_sw_a#show spantree {vlan number} wg_sw_a#show spantree 1 VLAN1 is executing the IEEE compatible Spanning Tree Protocol Bridge Identifier has priority 32768, address 0050.F037.DA00 Configured hello time 2, max age 20, forward delay 15 Current root has priority 0, address 00D0.588F.B600 Root port is FastEthernet 0/26, cost of root path is 10 Topology change flag not set, detected flag not set Topology changes 53, last topology change occured 0d00h17m14s ago Times: hold 1, topology change 8960 hello 2, max age 20, forward delay 15 Timers: hello 2, topology change 35, notification 2 Port Ethernet 0/1 of VLAN1 is Forwarding Port path cost 100, Port priority 128 Designated root has priority 0, address 00D0.588F.B600 Designated bridge has priority 32768, address 0050.F037.DA00 Designated port is Ethernet 0/1, path cost 10 Timers: message age 20, forward delay 15, hold 1 Slide 2 of 2 Purpose: Emphasize: Note: To adjust the STP timers or bridge priority on the 1900, use the following global configuration command: wg_sw_a(config)#spantree-template 1 ? forwarding-time Set a Spanning Tree FORWARD Interval hello-time Set a Spanning Tree HELLO Interval max-age Set a Spanning Tree MAX AGE Interval priority Set a Spanning Tree PRIORITY vlan Assign up to ten VLANs to a bridge template On the 1900, you can assign up to 4 spantree-templates then you can assign VLANs to each template. When you modify a template, you are modifying all the VLANs belonging to that template.

Visual Objective ... SUBNET VLAN POD 10.1.1.0 1 wg_ro_x, wg_sw_x, core_sw_a 10.2.2.0 2 wg_pc_a, core_server 10.3.3.0 3 wg_pc_b, core_server 10.4.4.0 4 wg_pc_c, core_server 10.5.5.0 5 wg_pc_d, core_server 10.6.6.0 6 wg_pc_e, core_server 10.7.7.0 7 wg_pc_f, core_server 10.8.8.0 8 wg_pc_g, core_server 10.9.9.0 9 wg_pc_h, core_server 10.10.10.0 10 wg_pc_i, core_server 10.11.11.0 11 wg_pc_j, core_server 10.12.12.0 12 wg_pc_k, core_server 10.13.13.0 13 wg_pc_l, core_server wg_pc_a 10.2.2.12 VLAN2 fa0/26 (port A) e0/1 e0/2 e0 wg_sw_a 10.1.1.10 wg_ro_a 10.1.1.11 wg_pc_l 10.13.13.12 VLAN13 fa0/26 (port A) e0/1 Slide 1 of 1 Purpose: Emphasize: Notes: Refer to the lab setup guide for lab instructions. e0/2 e0 wg_ro_l 10.1.1.121 wg_sw_l 10.1.1.120 ISL ... ISL fa0/1 fa0/12 fa0/24 core_ server 10.x.x.1 ISL core_sw_a 10.1.1.2

Visual Objective ... ... wg_pc_a 10.2.2.12 VLAN2 SUBNET VLAN POD 10.1.1.0 1 wg_ro_x, wg_sw_x, core_sw_a, core_sw_b 10.2.2.0 2 wg_pc_a, core_server 10.3.3.0 3 wg_pc_b, core_server 10.4.4.0 4 wg_pc_c, core_server 10.5.5.0 5 wg_pc_d, core_server 10.6.6.0 6 wg_pc_e, core_server 10.7.7.0 7 wg_pc_f, core_server 10.8.8.0 8 wg_pc_g, core_server 10.9.9.0 9 wg_pc_h, core_server 10.10.10.0 10 wg_pc_i, core_server 10.11.11.0 11 wg_pc_j, core_server 10.12.12.0 12 wg_pc_k, core_server 10.13.13.0 13 wg_pc_l, core_server fa0/26 (port A) fa0/27 (port B) e0/1 wg_sw_a 10.1.1.10 wg_pc_l 10.13.13.12 VLAN13 Slide 1 of 1 Purpose: Emphasize: Notes: Refer to the lab setup guide for lab instructions. fa0/26 (port A) fa0/27 (port B) e0/1 wg_sw_l 10.1.1.120 ... ... ISL ISL ISL ISL fa0/12 fa0/12 fa0/1 fa0/1 fa0/13 fa0/13 fa0/24 ISL core_ server fa0/14 ISL fa0/14 core_sw_a 10.1.1.2 core_sw_b 10.1.1.4 10.x.x.1

Summary After completing this chapter, you should be able to perform the following tasks: Configuring VLAN Configuring VTP Configuring a trunk Verifing Spanning Tree Operations Slide 1 of 1 Purpose: Emphasize:

Review Questions 1. What are the three VTP modes? 2. Over what type of port can VTP advertisements be sent? 3. VLAN ID is carried in the ________ header. 4. How do we assign a VLAN to a port? Slide 1 of 1 Purpose: Emphasize: Notes: Refer to the appendix for answer to the review questions.