Lab Objective:
The focus of this lab is to understand basic VLAN, VTP, DTP and STP implementation and configuration in Cisco IOS Catalyst switches.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please begin each and every lab by shutting down all interfaces on all switches and then manually re-enabling only the interfaces that are illustrated in this topology. |
Task 1
Disable VTP on all switches. All switches should support the configuration, modification and deletion of VLANs.
Task 2
Configure trunking on the switches so that all ports are explicitly trunking and DTP should never be used on any of these ports.
Task 3
Configure VLANs 100 and 200 on all switches and use the default IOS VLAN names. Explicitly configure switch DLS1 with a priority of 8192 so it is elected root for both of these VLANs. Additionally, also explicitly configure switch DLS2 so it is elected backup root for both VLANs.
Task 4
Configure Spanning Tree so that it will remain root bridge in the event that another switch is in advertently misconfigured with a lower priority for VLANs 100 and 200. Test and verify your configuration by specifying a priority of 0 for VLAN 100 on any switch within the STP network.
Task 5
Configure the trunk links on switch DLS2 so that they will be disabled automatically in the event that they do not receive BPDUs. Test and verify your configuration by disabling default BPDU transmission from one of the upstream switches.
Task 6
Ports FastEthernet0/1 through FastEthernet0/5 on switches ALS1 and ALS2 will be connected to hosts in the future. These hosts will reside in VLAN 100. Using only TWO commands, perform the following activities on these ports:
- Assign all of these individual ports to VLAN 100
- Configure the ports as static access port
- Enable PortFast for all the ports
- Disable bundling, i.e. EtherChannel, for these ports
Lab Validation
Task 1
| DLS1(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
| DLS2(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
| ALS1(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
| ALS2(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
Task 2
| DLS1(config)#interface range fa0/7, fa0/9, fa0/11 DLS1(config-if-range)#switchport trunk encapsulation dot1q DLS1(config-if-range)#switchport mode trunk DLS1(config-if-range)#switchport nonegotiate |
| DLS2(config)#interface range fa0/7, fa0/9, fa0/11 DLS2(config-if-range)#switchport trunk encapsulation dot1q DLS2(config-if-range)#switchport mode trunk DLS2(config-if-range)#switchport nonegotiate |
NOTE: If using the H2N racks, the ALS switches are 2950 switches and therefore support only 802.1Q encapsulation. There is no need to specify trunk encapsulation.
| ALS1(config)#interface range faste 0/7 , faste 0/9 , faste 0/11 ALS1(config-if-range)#switchport mode trunk ALS1(config-if-range)#switchport nonegotiate |
| ALS2(config)#interface range faste 0/7 , faste 0/9 , faste 0/11 ALS2(config-if-range)#switchport mode trunk ALS2(config-if-range)#switchport nonegotiate |
Verify your configuration using the show interfaces trunk command:
| DLS1#show interfaces trunk
Port Mode Encapsulation Status Native vlan |
| DLS2#show interfaces trunk
Port Mode Encapsulation Status Native vlan |
| ALS1#show interfaces trunk
Port Mode Encapsulation Status Native vlan |
| ALS2#show interfaces trunk
Port Mode Encapsulation Status Native vlan |
Task 3
| DLS1(config)#vlan 100 DLS1(config-vlan)#exit DLS1(config)#vlan 200 DLS1(config-vlan)#exit DLS1(config)#spanning-tree vlan 100 prior 8192 DLS1(config)#spanning-tree vlan 200 prior 8192 |
| DLS2(config)#vlan 100 DLS2(config-vlan)#exit DLS2(config)#vlan 200 DLS2(config-vlan)#exit DLS2(config)#spanning-tree vlan 100 priority 16384 DLS2(config)#spanning-tree vlan 200 priority 16384 |
| ALS1(config)#vlan 100 ALS1(config-vlan)#exit ALS1(config)#vlan 200 ALS1(config-vlan)#exit |
| ALS2(config)#vlan 100 ALS2(config-vlan)#exit ALS2(config)#vlan 200 ALS2(config-vlan)#exit |
Verify your configuration using the show spanning-tree root command:
| DLS1#show spanning-tree root
Root Hello Max Fwd |
| DLS2#show spanning-tree root
Root Hello Max Fwd |
| ALS1#show spanning-tree root
Root Hello Max Fwd |
| ALS2#show spanning-tree root
Root Hello Max Fwd |
Task 4
This task requires identifying designated ports and configuring the root guard feature on them. The root guard feature prevents a designated port from becoming a root port.
If a port on which the root guard feature receives a superior BPDU, it moves the port into a root-inconsistent state, thus maintaining the current root bridge status quo. Use the show spanning-tree vlan command to determine the current Spanning Tree port states as follows:
| DLS1#show spanning-tree vlan 100
VLAN0100 Interface Role Sts Cost Prio.Nbr Type |
| DLS2#show spanning-tree vlan 100
VLAN0100 Interface Role Sts Cost Prio.Nbr Type |
| ALS1#show spanning-tree vlan 100
VLAN0100 Interface Role Sts Cost Prio.Nbr Type |
| ALS2#show spanning-tree vlan 100
VLAN0100 Interface Role Sts Cost Prio.Nbr Type |
Following this, enable the root guard feature on all designated ports using the spanning-tree guard root interface configuration command. Referencing the list above, root guard would be enabled on the following interfaces or ports:
- Switch DSL1: Fa0/7, Fa0/9, Fa0/11
- Switch DLS2: Fa0/7, Fa0/9
- Switch ALS1: Fa0/11
- Switch ALS2: None – because this switch has no designated ports
This task is completed by enabling root guard on the ports above as follows:
| DLS1(config)#interface range fa0/7, fa0/9, fa0/11 DLS1(config-if-range)#spanning-tree guard root |
| DLS2(config)#interface range fa0/7, fa0/9 DLS2(config-if-range)#spanning-tree guard root |
| ALS1(config)#interface fastethernet 0/11 ALS1(config-if)#spanning-tree guard root |
Test your solution by setting the priority of a VLAN to 0 or 4096 and then verifying the port state on the adjacent segment designated bridge. For example, if you changed the priority of VLAN 100 on switch ALS2 to 0, all peer ports enabled for root guard with which this switch connects will be placed into a root inconsistent state as follows:
| ALS2(config)#spanning-tree vlan 100 priority 0 |
| DLS1# *Mar 1 01:21:28.851: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port FastEthernet0/9 on VLAN0100. |
| DLS2# *Mar 1 01:21:31.535: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port FastEthernet0/7 on VLAN0100. |
| ALS1# *Mar 1 01:24:39.903: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port FastEthernet0/11 on VLAN0100. |
Aside from the logged message, you can also use the show spanning-tree inconsistentports and the show spanning-tree interfacecommands to view root inconsistent ports:
| DLS1#show spanning-tree inconsistentports
Name Interface Inconsistency |
| DLS1#show spanning-tree interface fastethernet 0/9
Vlan Role Sts Cost Prio.Nbr Type |
Task 5
This task requires the configuration of Loop Guard on switch DLS2. The Loop Guard detects root ports and blocked ports, and ensures they continue to receive BPDUs. When enabled, should one of these ports stop receiving BPDUs, it is moved into a loop-inconsistent state.
| ALS2(config)#interface range faste 0/7 , faste 0/9 , faste 0/11 ALS2(config-if-range)#spanning-tree guard loop |
NOTE: The Loop Guard feature can also be enabled globally as follows:
| ALS2(config)#spanning-tree loopguard default |
Test this configuration by filtering BPDUs from one of the connected switches as follows:
| DLS1(config)#interface fastethernet 0/9 DLS1(config-if)#spanning-tree bpdufilter enable |
After this configuration, the following log messages are printed on the console of ALS2:
| ALS1# 01:41:26: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port FastEthernet0/9 on VLAN0100. 01:41:28: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port FastEthernet0/9 on VLAN0200. |
Aside from the logged message, you can also use the show spanning-tree inconsistentports and the show spanning-tree interfacecommands to view root inconsistent ports:
| ALS2#show spanning-tree inconsistentports
Name Interface Inconsistency Number of inconsistent ports (segments) in the system : 2 |
| ALS2#show spanning-tree interface fastethernet 0/9
Vlan Role Sts Cost Prio.Nbr Type |
Task 6
While seemingly difficult, this task is actually very simple and requires the configuration of the switchport access vlan and switchport hostcommands. The switchport host command is an inbuilt Cisco IOS macro that performs three actions under the specified port(s):
- It configures the switchport for access mode
- It enables portfast
- It disables Etherchannel capabilities for the port
This task is completed as follows:
| ALS1(config)#interface range fastethernet 0/1 – 5 ALS1(config-if-range)#switchport access vlan 100 ALS1(config-if-range)#switchport host switchport mode will be set to access spanning-tree portfast will be enabled channel group will be disabled ALS1(config-if-range)#end |
| ALS2(config)#interface range fastethernet 0/1 – 5 ALS2(config-if-range)#switchport access vlan 100 ALS2(config-if-range)#switchport host switchport mode will be set to access spanning-tree portfast will be enabled channel group will be disabled ALS2(config-if-range)#end |
Verify your configuration by looking at the switch interface configuration or using the show interfaces <interface> switchport command:
| ALS1#show running-config interface fastethernet 0/1 Building configuration… Current configuration : 109 bytes |
| ALS1#show interfaces fastethernet 0/1 switchport Name: Fa0/1 Switchport: Enabled Administrative Mode: static access Operational Mode: static access Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: native Negotiation of Trunking: Off Access Mode VLAN: 100 (VLAN0100) Trunking Native Mode VLAN: 1 (default) Voice VLAN: none Administrative private-vlan host-association: none Administrative private-vlan mapping: none Administrative private-vlan trunk native VLAN: none Administrative private-vlan trunk encapsulation: dot1q Administrative private-vlan trunk normal VLANs: none Administrative private-vlan trunk private VLANs: none Operational private-vlan: none Trunking VLANs Enabled: ALL Pruning VLANs Enabled: 2-1001 Capture Mode Disabled Capture VLANs Allowed: ALL Protected: false Appliance trust: none |
Final Switch Configurations
DLS1
|
DLS1#term len 0 Current configuration : 4013 bytes DLS1# |
DLS2
|
DLS2#term len 0 Current configuration : 3988 bytes DLS2# |
ALS1
|
ALS1#term len 0 Current configuration : 1340 bytes ALS1# |
ALS2
|
ALS2#term len 0 Current configuration : 1419 bytes ALS2# |