1. © 2003, Cisco Systems, Inc. All rights reserved. 2-1 Introducing Campus Networks

2. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-2 Cisco Enterprise Architecture

3. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-3 Campus Provides high availability Quality of service (QoS) prevents oversubscription to ensure that real- time traffic, such as voice and video, or critical data is not dropped or delayed. Integrated security protects against and mitigates the impact of worms, viruses, and other attacks on the network, even at the port level. Provides the flexibility to add IP Security (IPSec) and Multiprotocol Label Switching Virtual Private Networks (MPLS VPNs), identity and access management, and VLANs to compartmentalize access. The enterprise campus architecture will be the focus of this courseware. Combines switching and routing with tightly integrated productivity- enhancing technologies, including IP Communications, mobility, and advanced security.

4. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-4 Data Center Cohesive, adaptive network architecture. Provides departmental staff, suppliers, or customers with secure access to applications and resources. Streamlines management, significantly reducing overhead. Redundant data centers provide backup. The network and devices offer server and application load balancing to maximize performance.

5. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-5 Branch Extends head-office applications and services, such as security, IP Communications, and advanced application performance, to remote locations, users, or branches. Integrates security, switching, network analysis, caching, and converged voice and video services into a series of integrated services routers Can deploy new services when they are ready without buying new equipment.

6. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-6 Teleworker Allows enterprises to securely deliver voice and data services to remote small or home offices over a standard broadband access service. Flexible work environment for employees. Extend campus security policies to the teleworker. “Always-on” VPN and gain access to authorized applications and services, including IP phone.

7. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-7 Nonhierarchical Network Devices Large collision domain Large broadcast domain High latency Difficult to troubleshoot

8. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-8 Issues Without VLANs, large unbounded broadcast domain No traffic between VLANs without layer 3 routing Potential for bridge loops increases, therefore, the use of a Spanning Tree Protocol (STP) becomes imperative. Servers not centrally located Layer 2 Switching Hardware-based bridging Wire-speed performance Collision domain per port Traffic containment based on MAC address

9. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-9 Layer 3 Routing Single broadcast domain per interface ACLs can be applied between segments Issues High per-port cost than switches Layer 3 processing required High latency over Layer 2 switching

10. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-10 Multilayer Switching Multilayer switching is hardware- based switching and routing integrated into a single platform. A multilayer switch does everything to a frame and packet that a traditional switch or router does, including the following: Combined functionality –Layer 2 switching –Layer 3 switching –Layer 4 switching Low latency High-speed scalability

11. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-11 Issues with Multilayer Switches in a Nonhierarchical Network Single point of failure for Layer 2 and Layer 3 Multilayer switch functionality may be underutilized if a multilayer switch is simply a replacement for the traditional role of a router in a nonhierarchical network Spanning tree complexity Servers not centrally located

12. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-12 Hierarchical Campus Model

13. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-13 Building Access layer User access to network devices. Layer 2 and 3 broadcast multicast suppression, QoS, and access control. Network campus, incorporates switched LAN devices with ports that provide connectivity to workstations and servers. WAN environment, provides access to the corporate network across WAN technology.

14. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-14 Building Access submodule (also known as Building Access layer): Contains: –end-user workstations, –IP phones –Layer 2 access switches Connect devices to the Building Distribution submodule. The Building Access submodule performs services such as: –support for multiple VLANs –private VLANs –establishment of trunk links to the Building Distribution layer –IP phones. Building Access submodule

15. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-15 Building Distribution layer Aggregates the wiring closets and uses switches to segment workgroups and isolate network problems. Generally performs IP routing and implements QoS and access control.

16. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-16 Building Distribution submodule (also known as Building Distribution layer): Provides aggregation of building access devices, often using Layer 3 switching. Performs routing, QoS, and access control. Traffic generally flows through the building distribution switches and onto the campus core or backbone. Provides fast failure recovery because each building distribution switch maintains two equal-cost paths in the routing table for every Layer 3 network number. Each building distribution switch has connections to redundant switches in the core. Building Distribution submodule

17. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-17 Building Core layer High-speed backbone Designed to switch packets as fast as possible. Because the core is critical for connectivity, it must provide a high level of availability and adapt to changes very quickly Also known as the Campus Backbone Generally uses Layer 3 switches with added routing, QoS and security features.

18. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-18 Campus Backbone submodule (also known as Building Core layer): Provides redundant and fast-converging connectivity between buildings and the Server Farm and Edge Distribution modules. The purpose is to switch traffic as fast as possible between Campus Infrastructure submodules and destination resources. Forwarding decisions should be made at the ASIC level whenever possible. Routing, ACLs, and processor-based forwarding decisions should be avoided at the core and implemented at building distribution devices whenever possible. High-end Layer 2 or Layer 3 switches are used at the core for high throughput, with optimal routing, QoS, and security capabilities available when needed. Campus Backbone submodule

19. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-19 ECNM Functional Areas The ECNM introduces modularity by dividing the network into functional areas that ease design, implementation, and troubleshooting tasks. An enterprise campus is defined as one or more buildings, with multiple virtual and physical networks, connected across a high- performance, multilayer-switched backbone

20. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-20 Enterprise Composite Network Model

21. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-21 ECNM Enterprise Campus: Hierarchical, highly robust campus network that offers performance, scalability, and availability. Network elements required for independent operation within a single campus, such as access from all locations to central servers. Does not offer remote connections or Internet access.

22. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-22 ECNM Enterprise Campus: Campus Infrastructure module: –connects users within the campus to the Server Farm and Edge Distribution modules. –one or more floors or buildings connected to the Campus Backbone Network Management module: –Performs system logging and authentication as well as network monitoring and general configuration management functions. Server Farm module: –Contains e-mail and corporate servers providing application, file, print, e-mail, and Domain Name System (DNS) services to internal users. Edge Distribution module: –Aggregates the connectivity Enterprise Edge and routes the traffic into the Campus Backbone.

23. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-23 ECNM Enterprise Edge: Aggregates connectivity external to the enterprise network. As traffic comes into the campus, this area filters traffic from the external resources and routes it into the Enterprise Campus functional area. It contains all of the network elements for efficient and secure communication between the enterprise campus and remote locations, remote users, and the Internet. The Enterprise Edge would replace the Demilitarized Zone (DMZ) of most networks.

24. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-24 Service Provider Edge: This functional area represents connections to resources external to the campus. This area facilitates communication to WAN and Internet service provider technologies. ECNM

25. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-25 Campus Infrastructure Module

26. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-26 Switch Configuration Interfaces In the era of the early high-end Cisco Catalyst switches, the Cisco Catalyst operating system (CatOS) and the command interface were significantly different from the Cisco IOS mode navigation interfaces available on all newer Cisco Catalyst platforms. The two interfaces have different features and a different prompt and CLI syntax. Two interfaces are used to configure Cisco Catalyst switches Cisco CatOS Cisco IOS Cisco CatOS was traditionally used to configure Layer 2 parameters on the modular switches Cisco Catalyst 4000, 5500, 6500 Series These switches now support Cisco IOS (native IOS) Cisco IOS is standard software for most other switches and for Layer 3 configuration on the modular switches.

27. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-27 Cisco Catalyst Operating System (CatOS) CatOS isused to configure Layer 2 parameters. CatOS configuration commands are prefaced with the keyword set. Console(enable) set port enable 3/5 Layer 3 configuration is implemented on MSFC with Cisco IOS. Some platforms can now use Cisco IOS to configure both Layer 2 and Layer 3 (native IOS). Cisco Catalyst 4000, 5500, and 6500 switches

28. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-28 Cisco IOS Interface On most Catalyst switches, Cisco IOS interface is standard for Layer 2 configuration Layer 3 configuration on multilayer switch

29. © 2003, Cisco Systems, Inc. All rights reserved. 2-29 Introducing Campus Networks

30. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-30 © 2002, Cisco Systems, Inc. All rights reserved. 30 Basic Layer 2 Switching and Bridging Functions

31. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-31 Objectives Upon completing this lesson, you will be able to: Describe Layer 2 switching and bridging operations and modes Describe how LAN switches use and populate the MAC address table

32. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-32 Bridges Bridge Categories Local Bridge –An internetworking device designed to interconnect two bridges within close proximity of one another –Also support network separation To reduce network utilization by splitting a LAN into more than one independent LAN Remote Bridge –Converts LAN traffic into a wide area protocol thus allowing a LAN to be connected to a WAN

33. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-33 Types of Bridges Transparent Bridge Remote bridge with identical data link protocol Can support different physical media Translating Bridge Connection with different data link protocol –Frame conversion For example, Ethernet to Token ring or Token ring to Ethernet May require assembly and reassembly –Transmission rate conversion

34. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-34 Bridging and Switching Bridges forward traffic based on MAC level address A bridge may perform protocol conversion or speed matching between different LAN types Bridges provides buffering of packets A switch is a bridge with all ports use the same frame type; also called a LAN switch to distinguish from an ATM or telecommunications switch

35. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-35 Why Bridging and Switching? Decrease traffic on LAN segments Extend LAN without increasing congestion Bridge different network protocols Speed matching Security Reliability: fault isolation and bandwidth balancing

36. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-36 Traffic and LAN Size Joining LAN segments with a hub or repeater increases traffic. All machines share the same media (same collision domain). A: total traffic 6 MbpsB: total traffic 5 Mbps A+B: total traffic 11 Mbps repeater

37. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-37 Switched LAN Segments A switch only forwards packets when necessary. learns network addresses of machines connected to each port doesn’t forward traffic between machines on same port provides packet buffering and retiming, reducing collisions does forward all broadcast traffic may forward multicast traffic, depending on switch A sw/ B: traffic 7 MbpsswitchB sw/ A: traffic 6 Mbps

38. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-38 LAN Extension a switch can extend length limit of network, since it provides packet retiming and retransmission bridge: different media and protocol to extend length limit switches are not subject to repeater count limit on ethernet Fast Ethernet switch Fast Ethernet 300 m wireless bridge up to 40 km

39. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-39 Bridging Different Protocols a bridge can convert frame formats requires compatible network addresses, e.g. ethernet & token ring are OK, but not ethernet and ATM frame conversion may lose some information about the frame Ethernet bridge Token Ring

40. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-40 Protocol Conversion Problems Ethernet does not have frame “address seen” or “copied” bits (set by receiver in Token Ring Frame Status byte) Ethernet does not have priorities or access control flags Token Ring frame may be too long for ethernet Maximum throughput of ethernet and token ring not the same: some frames may be dropped Token Ring doesn’t have a length field: bridge must buffer and compute Data 0 - 18180 Frame control Destination address 1 Start delimiter 1 byte Access control Source address End delimiter Frame status Frame CRC 66411 1 Data 46 - 1500 SOH Destination address Source address Frame CRC 664 1 byte length 2 Ethernet Frame Token Ring Frame

41. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-41 Speed Matching A switch can connect segments operating at different speeds How to handle overload of a slow or busy segment? back pressure (false collisions) drop frames Ethernet switches can support 10, 100 Mbps, and gigabit Bridging ethernets is simple: packet formats are the same Fast Ethernet hub switch 10 Mbps Ethernet hub Fast Ethernet server Gigabit Ethernet server 10 Mbps ethernet 100 Mbps ethernet

42. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-42 Security A hub forwards all packets to all ports. Any host can listen to packets to/from another host, using programs like tcpdump, etherwatch, or snoop. Hub: shared media access Switch: selective access A switch only forwards packets to port containing the destination host. Computers on other ports cannot eavesdrop. rats! ooooh..

43. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-43 Address learning Forward/filter decision Loop avoidance Ethernet Switches and Bridges

44. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-44 Cut-Through Switch checks destination address and immediately begins forwarding frame. Fragment-Free Switch checks the first 64 bytes, then immediately begins forwarding frame. Store and Forward Complete frame is received and checked before forwarding. Transmitting Frames

45. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-45 MAC Address Table Initial MAC address table is empty.

46. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-46 Learning Addresses Station A sends a frame to station C. Switch caches the MAC address of station A to port E0 by learning the source address of data frames. The frame from station A to station C is flooded out to all ports except port E0 (unknown unicasts are flooded).

47. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-47 Learning Addresses (Cont.) Station D sends a frame to station C. Switch caches the MAC address of station D to port E3 by learning the source address of data frames. The frame from station D to station C is flooded out to all ports except port E3 (unknown unicasts are flooded).

48. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-48 Filtering Frames Station A sends a frame to station C. Destination is known; frame is not flooded.

49. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-49 Filtering Frames (Cont.) Station A sends a frame to station B. The switch has the address for station B in the MAC address table.

50. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-50 Station D sends a broadcast or multicast frame. Broadcast and multicast frames are flooded to all ports other than the originating port. Broadcast and Multicast Frames

51. © 2003, Cisco Systems, Inc. All rights reserved. BCMSN v2.0—2-51 Summary Ethernet switches and bridges increase the available bandwidth of a network by creating dedicated network segments and interconnecting the segments. Switches and bridges use one of three operating modes to transmit frames: store and forward, cut-through, and fragment-free. Switches and bridges maintain a MAC address table to store address-to-port mappings so it can determine the locations of connected devices. When a frame arrives with a known destination address, it is forwarded only on the specific port connected to the destination station.