1. Saeed Darvish Pazoki – MCSE, CCNA Abstracted From: Cisco Press – ICND 1 – Chapter 10 Ethernet Switch Configuration 1

2. Perspectives on Network Verification and Troubleshooting Isolating Problems at Layer 3, and Then at Layers 1 and 2 Most troubleshooting in real IP networks today begins with what the end user sees and experiences. From there, the analysis typically moves quickly to an examination of how well Layer 3 is working. 2

3. Perspectives on Network Verification and Troubleshooting Isolating Problems at Layer 3, and Then at Layers 1 and 2 The routing steps shown in previous slide are as follows: Step 1 PC1 sends the packet to its default gateway (R1) because the destination IP address is in a different subnet. Step 2 R1 forwards the packet to R2 based on R1’s routing table. Step 3 R2 forwards the packet to the web server based on R2’s routing table. Step 4 The web server sends a packet back toward PC1 based on the web server’s default gateway setting (R2). Step 5 R2 forwards the packet destined for PC1 by forwarding the packet to R1 according to R2’s routing table. Step 6 R1 forwards the packet to PC1 based on R1’s routing table. 3

4. Perspectives on Network Verification and Troubleshooting Isolating Problems at Layer 3, and Then at Layers 1 and 2 To further isolate the problem and find the root causes, the engineer would need to determine the following: The MAC address of PC1 and of R1’s LAN interface The switch interfaces used on SW1 and SW2 The interface status of each interface The expected forwarding behavior of a frame sent by PC1 to R1 as the destination MAC address By gathering and analyzing these facts, the engineer can most likely isolate the problem’s root cause and fix it. 4

5. Verifying the Network Topology with Cisco Discovery Protocol The proprietary Cisco Discovery Protocol (CDP) discovers basic information about neighboring routers and switches without needing to know the passwords for the neighboring devices. To discover information, routers and switches send CDP messages out each of their interfaces. The messages essentially announce information about the device that sent the CDP message. Devices that support CDP learn information about others by listening for the advertisements sent by other devices. 5

6. Verifying the Network Topology with Cisco Discovery Protocol CDP discovers several useful details from the neighboring Cisco devices: Device identifier: Typically the hostname Address list: Network and data-link addresses Local interface: The interface on the router or switch issuing the show cdp command with which the neighbor was discovered Port identifier: Text that identifies the port used by the neighboring device to send CDP messages to the local device Capabilities list: Information on what type of device it is (for instance, a router or a switch) Platform: The model and OS level running in the device 6

7. Verifying the Network Topology with Cisco Discovery Protocol 7

8. To avoid the possibility of allowing an attacker to learn details about each switch, CDP can be easily disabled. Cisco recommends that CDP be disabled on all interfaces that do not have a specific need for it. The most likely interfaces to need to use CDP are interfaces connected to other Cisco routers and switches and interfaces connected to Cisco IP Phones. Otherwise, CDP can be disabled per interface using the no cdp enable interface subcommand. The no cdp run global command disables CDP for the entire switch, with the cdp run global command re-enabling CDP globally. 8

9. Verifying the Network Topology with Cisco Discovery Protocol 9

10. 10

11. Analyzing Layer 1 and 2 Interface Status Interface Status Codes and Reasons for Nonworking States The show interfaces status command lists a different single interface status code. This single interface status code corresponds to different combinations of the traditional two code interface status codes and can be easily correlated to those codes. 11

12. Analyzing Layer 1 and 2 Interface Status Interface Speed and Duplex Issues On switches and routers, the speed {10 | 100 | 1000} interface subcommand and the duplex {half | full} interface subcommand set these values. The show interfaces and show interfaces status commands list both the speed and duplex settings on an interface. a-full means full duplex as auto-negotiated, whereas full means full duplex but as manually configured. 12

13. Analyzing Layer 1 and 2 Interface Status Interface Speed and Duplex Issues 13

14. Common Layer 1 Problems on Working Interfaces Some Layer 1 problems prevent a switch interface from ever reaching the connect (up/up) state. When the interface reaches the connect state, the switch tries to use the interface and keep various interface counters. These interface counters can help identify problems that can occur even though the interface is in a connect state. First, consider a couple of common reasons why Ethernet frames experience errors during transmission. When an Ethernet frame passes over a UTP cable, the electrical signal may encounter problems. The cable could be damaged, for example, if it lies under carpet. If the user’s chair keeps squashing the cable, eventually the electrical signal can degrade. Additionally, many sources of electromagnetic interference (EMI) exist; for example, a nearby electrical power cable can cause EMI. EMI can change the electrical signal on the Ethernet cable. whenever the electrical signal degrades, the receiving device may receive a frame whose bits have changed value. These frames do not pass the error detection logic as implemented in the FCS field in the Ethernet trailer. 14

15. Common Layer 1 Problems on Working Interfaces The receiving device discards the frame and counts it as some kind of input error. Cisco switches list this error as a CRC error (cyclic redundancy check [CRC] is an older term referring to the frame check sequence [FCS] concept) Now, consider the concept of an Ethernet collision versus a late collision, both of which are tracked with interface counters by Cisco switches. Collisions occur as a normal part of the half-duplex logic imposed by CSMA/CD, so a switch interface with an increasing collisions counter may not even have a problem. If a LAN design follows cabling guidelines, all collisions should occur by the end of the 64th byte of any frame. When a switch has already sent 64 bytes of a frame, and the switch receives a frame on that same interface, the switch senses a collision. In this case, the collision is a late collision, and the switch increments the late collision counter in addition to the usual CSMA/CD actions to send a jam signal, wait a random time, and try again. 15

16. Common Layer 1 Problems on Working Interfaces 16

17. Common Layer 1 Problems on Working Interfaces Three common LAN problems can be found using these counters: Excessive interference on the cable. A duplex mismatch. Jabber. Excessive interference on the cable can cause the various input error counters to keep growing larger, especially the CRC counter. In particular, if the CRC errors grow, but the collisions counters do not, the problem may simply be interference on the cable. 17

18. Common Layer 1 Problems on Working Interfaces Both duplex mismatches and jabber can be partially identified by looking at the collisions and late collision counters. Jabber refers to cases in which the NIC ignores Ethernet rules and sends frame after frame without a break between the frames. With both problems, the collisions and late collision counters could keep growing. In particular, a significant problem exists if the collision counters show that more than.1% of all the output frames have collided. Duplex mismatch problems can be further isolated by using the show interface command. Isolating jabber problems requires much more effort, typically using more specialized LAN cabling troubleshooting tools. Finally, an incrementing late collisions counter typically means one of two things: The interface is connected to a collision domain whose cabling exceeds Ethernet cable length standards. The interface is using half duplex, and the device on the other end of the cable is using full duplex. 18

19. Common Layer 1 Problems on Working Interfaces 19

20. Analyzing the Layer 2 Forwarding Path with the MAC Address Table The show mac address-table EXEC command displays the contents of a switch’s MAC address table. NOTE The MAC table entries in Example bellow several additional entries, entries that list a port of “CPU” and refer to MAC addresses used by the switch for overhead traffic such as CDP and STP. These entries tell the switch to send frames destined for these MAC addresses to the switch’s CPU. 20

21. Analyzing the Layer 2 Forwarding Path with the MAC Address Table 21

22. Analyzing the Layer 2 Forwarding Path with the MAC Address Table Analyzing the Forwarding Path The show vlan brief command lists all the interfaces on each switch as being assigned to default VLAN 1. The switch forwarding logic can be summarized as follows: Step 1 Determine the VLAN in which the frame should be forwarded. On access interfaces this is based on the access VLAN associated with the incoming interface. Step 2 Look for the frame’s destination MAC address in the MAC address table, but only for entries in the VLAN identified in Step 1. If the destination MAC is... A. Found (unicast), forward the frame out the only interface listed in thematched address table entry. B. Not found (unicast), flood the frame out all other access ports (except the incoming port) in that same VLAN. C. Broadcast or multicast, flood the frame out all other access ports (except the incoming port) in that same VLAN. 22

23. Analyzing the Layer 2 Forwarding Path with the MAC Address Table Analyzing the Forwarding Path Using this process as a guide, consider a frame sent by Barney to its default gateway, R1 (0200.5555.5555). Using the same switch forwarding logic steps, the following occurs: Step 1 SW1 receives the frame on its Fa0/12 interface and sees that it is assigned to access VLAN 1. Step 2 SW1 looks for its MAC table entry for 0200.5555.5555, in the incoming interface’s VLAN (VLAN 1), in its MAC address table. A. SW1 finds an entry, associated with VLAN 1, outgoing interface Gi0/1, so SW1 forwards the frame only out interface Gi0/1. At this point, the frame with source 0200.2222.2222 (Barney) is on its way to SW2. You can then pick up SW2’s logic, with the following explanation numbered to match the forwarding process summary: Step 1 SW2 receives the frame on its Gi0/2 interface and sees that Gi0/2 is assigned to access VLAN 1. Step 2 SW2 looks for its MAC table entry for 0200.5555.5555, in the incoming interface’s VLAN (VLAN 1), in its MAC address table. oA. SW2 finds an entry, associated with VLAN 1, outgoing interface Fa0/13, so SW2 forwards the frame only out interface Fa0/13. 23