Category Archives: 02) SWITCH 300-115

CCNP SWITCH 300-115 2.1 Configure and verify switch security features

2.1.a DHCP snooping

In this segment we will cover DHCP, as well as DHCP Snooping. It seems the blueprint is remiss in mentioning DHCP in its own line item so we will briefly cover it here as you cannot have DHCP Snooping without DHCP.

DHCP is easy enough; there are only 2 requirements for it so long as you are using a single subnet, as we will do here for the sake of simplicity. The minimum requirements call for a default-router and a DHCP network for address assignment. You could establish a lease period, DNS, and many other delimiters,  but they are not minimum requirements. It is a good idea to include a domain-name but usually that has already been configured.

DHCP is the Dynamic Host Configuration Protocol. It eases administration by allowing clients to broadcast for Ip addresses and a default gateway, among other parameters. A lot easier than statically configuring a bunch of windows or linux boxes in any size environment. The usual method is for a dedicated server to handle the chore, but Cisco was kind enough to include it in its routers and switches, and on it’s exams.

So the first step  will be to set up a DHCP server. Keep in mind the acronym DORA, dis, off, req, ack and you can easily memorize the dhcp process. Discover, Offer, Request, Acknowledge.

Option 82 or the information option is a player in the VIRL canvas. Option 82 is turned on by default and does further fact checking for validity on untrusted ports especially in the case of relays. We can avoid this by turning off option 82 at the switch, or by enabling option 82 on the access ports, the untrusted ports, however, here we will turn it off on the switch. You can find out more detail about option 82 on the internet, in fact Petr Lapukhov has a great article about it on his INE blog. Just do a search for “option 82 Petr” and that should be your first hit.

Let’s get down to configuration.

Now that we have DHCP in place and operational, we can talk about DHCP Snooping. DHCP Snooping is designed to disallow rogue DHCP servers from inhabiting your network and dishing out false Ip addresses and gateways to your clients. This is performed by establishing a trust between authorized devices and thereby building a reference database for cross checking. Remember, only untrusted connections will be leased ip addresses and assigned to the snooping database, along with their associated mac’s and vlan’s. It is vital to understand that trusted connections are established between server and switch or router and switch or switch and switch, not switch and access ports.

There are three essential items to get DHCP Snooping operational. Of course there are other options but we will discuss the minimum. They
are:

Turn on dhcp snooping

turn on dhcp snooping for the Vlan or Vlan’s

and establish trust between the server and switch.

here we go:

VIDEO

https://www.youtube.com/watch?v=_pRDz-B_O8U

 

 

SWITCH 300-115 1.5 Configure and verify EtherChannels

1.5.d EtherChannel misconfiguration guard
Etherchannel misconfiguration guard is enabled by default and does what it says it does; helps prevent misconfiguration of etherchannels.
We know that the interfaces we bundle into a channel need to have matching configurations or they will not be suitable, but often enough they are mistakenly put together in a hurry without verifying both sides interfaces first. Etherchannel misconfiguration guard will place the channel in errdissable state and issues an error message if it detects a possible misconfiguration.
To verify that etherchannel guard misconfig is in place as the default use:
sh spann summ | i Ether
If you do break the etherchannel by purposely misconfiguring, or not, you can reenable the channel with shut/no shut or by adjusting the errdisable recovery time interval.
VIDEO

1.5 Configure and verify EtherChannels

 

1.5.c Load balancing

by default load balancing is:

SW3#sh etherchannel load
EtherChannel Load-Balancing Configuration:
src-mac    

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source MAC address                                                      
  IPv4: Source MAC address                                                      
  IPv6: Source MAC address    

from Catalyst 3750 Switch Software Configuration Guide 1-8

EtherChannel balances the traffic load across the links in a channel by reducing part of the binary pattern formed from the addresses in the frame to a numerical value that selects one of the links in the channel.
EtherChannel load balancing can use MAC addresses or IP addresses, source or destination addresses, or both source and destination addresses. The selected mode applies to all EtherChannels configured on the switch. You configure the load balancing and forwarding method by using the port-channel load-balance global configuration command.

With source-MAC address forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the channel based on the source-MAC address of the incoming packet. Therefore, to provide load balancing, packets from different hosts use different ports in the channel, but packets from the same host use the same port in the channel.

With destination-MAC address forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the channel based on the destination host’s MAC address of the incoming packet. Therefore, packets to the same destination are forwarded over the same port, and packets to a different destination are sent on a different port in the channel.
With source-and-destination MAC address forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the channel based on both the source and destination MAC addresses.

This forwarding method, a combination source-MAC and destination-MAC address forwarding methods of load distribution, can be used if it is not clear whether source-MAC or destination-MAC address forwarding is better suited on a particular switch.

With source-and-destination MAC-address forwarding, packets sent from host A to host B, host A to host C, and host C to host B could all use different ports in the channel.
With source-IP address-based forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the EtherChannel based on the source-IP address of the incoming packet.
Therefore, to provide load-balancing, packets from different IP addresses use different ports in the channel, but packets from the same IP address use the same port in the channel.
With destination-IP address-based forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the EtherChannel based on the destination-IP address of the incoming packet. Therefore, to provide load-balancing, packets from the same IP source address sent to different IP destination addresses could be sent on different ports in the channel. But packets sent from different source IP addresses to the same destination IP address are always sent on the same port in the channel.
With source-and-destination IP address-based forwarding, packets are sent to an EtherChannel and distributed across the EtherChannel ports, based on both the source and destination IP addresses of the incoming packet. This forwarding method, a combination of source-IP and destination-IP address-based forwarding, can be used if it is not clear whether source-IP or destination-IP address-based forwarding is better suited on a particular switch. In this method, packets sent from the IP address A to IP address B, from IP address A to IP address C, and from IP address C to IP address B could all use different ports in the channel.

Different load-balancing methods have different advantages, and the choice of a particular
load-balancing method should be based on the position of the switch in the network and the kind of traffic that needs to be load-distributed.

SWITCH 300-115 1.5 Configure and verify EtherChannels

1.5.b Layer 2, Layer 3
Surprisingly, the Switch blueprint does not mention routed ports or SVI’s (switched virtual interfaces) specifically. However, in this section we get the first hint of Layer 3 on a switch so now is a good time to expound a bit. Naturally, the Certification Guides and  Foundation Learning Guides are indispensible throughout the certification process, and while the blueprint is a great road map, it may not mention everything. So you need a bit of everything and for that there is a whole internet out there to be had. So go forth and be all up inside the internet.
Multilayer switching is what it says it is; switches can support more layers than layer 2. Simply put, the switch is a router.
Multiple access ports can be assembled into one Vlan and share a common Gateway address to other layer 3 capable devices. This describes a Switched Virtual interface.
The three hallmarks of SVI creation are:
make a vlan
make an interface vlan, assign it an ip address and turn it up with no shut
and make sure to assign at least 1 port to the vlan.
By default an SVI is created for you, Vlan 1, you just need to give it an address, and you know by default all ports belong to Vlan 1 out of the box.
VIDEO