Lab Objective:
The focus of this lab is to understand basic HSRP and STP convergence tweaking implementation and configuration in Cisco IOS Catalyst switches.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please begin each and every lab by shutting down all interfaces on all switches and then manually re-enabling only the interfaces that are illustrated in this topology. |
Task 1
Disable VTP on all switches and create the following VLANs:
- DLS1: VLAN 100 and VLAN 200
- DLS2: VLAN 100 and VLAN 200
- ALS1: VLAN 100
- ALS2: VLAN 200
Task 2
Disable DTP and configure trunking on all switches as follows:
- The trunk links on switch DLS1 should only allow VLANs 1, 100 and 200
- The trunk links on switch DLS2 should only allow VLANs 1, 100 and 200
- The trunk links on switch ALS1 should only allow VLANs 1 and 100
- The trunk links on switch ALS2 should only allow VLANs 1 and 200
Task 3
Configure the following SVIs and interfaces on the switches in the topology:
- DLS1: Interface VLAN 100: IP address 100.1.1.1/24
- DLS1: Interface VLAN 200: IP address 200.1.1.1/24
- DLS1: Interface Loopback0: IP address 192.1.1.1/24
- DLS2: Interface VLAN 100: IP address 100.1.1.2/24
- DLS2: Interface VLAN 200: IP address 200.1.1.2/24
- ALS1: Interface VLAN 100: IP address 100.1.1.3/24
- ALS2: Interface VLAN 100: IP address 200.1.1.3/24
Task 4
Configure HSRP with preemption and MD5 authentication on DLS1 and DLS2 as follows:
- DLS1: VLAN 100: HSRP IP address 100.1.1.254, group 1, priority 200, MD5 password: ONE
- DLS1: VLAN 200: HSRP IP address 200.1.1.254, group 2, priority 200, MD5 password: TWO
- DLS2: VLAN 100: HSRP IP address 100.1.1.254, group 1, priority 150, MD5 password: ONE
- DLS2: VLAN 200: HSRP IP address 200.1.1.254, group 2, priority 150 MD5 password: TWO
Task 5
In the future, switch DLS1 will be configured to track an uplink port to the WAN routers. To test this solution, configure HSRP on switch DLS1 to track the Loopback0 interface. Should Loopback0 be shut down, ensure switch DLS2 becomes the active gateway for both groups.
Task 6
To allow for faster 802.1D convergence, configure the lowest possible diameter that will allow all devices in the network to communicate. In addition to this, ensure that your Layer 2 and Layer 3 topologies are consistent, i.e. the primary gateway should be the root for the corresponding VLAN. Finally, ensure that switches ALS1 and ALS2 can also ping each other.
Lab Validation
Task 1
| DLS1(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. DLS1(config)#vlan 100 DLS1(config-vlan)#exit DLS1(config)#vlan 200 DLS1(config-vlan)#exit |
| DLS2(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. DLS2(config)#vlan 100 DLS2(config-vlan)#exit DLS2(config)#vlan 200 DLS2(config-vlan)#exit |
| ALS1(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. ALS1(config)#vlan 100 ALS1(config-vlan)#exit |
| ALS2(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. ALS2(config)#vlan 200 ALS2(config-vlan)#exit |
Task 2
| DLS1(config)#interface range fasteth 0/7 , fasteth 0/9 , fasteth 0/11 DLS1(config-if-range)#switchport DLS1(config-if-range)#switchport trunk encapsulation dot1q DLS1(config-if-range)#switchport mode trunk DLS1(config-if-range)#switchport trunk allowed vlan 1,100,200 DLS1(config-if-range)#switchport nonegotiate DLS1(config-if-range)#exit |
| DLS2(config)# interface range fasteth 0/7 , fasteth 0/9 , fasteth 0/11 DLS2(config-if-range)#switchport DLS2(config-if-range)#switchport trunk encapsulation dot1q DLS2(config-if-range)#switchport mode trunk DLS2(config-if-range)#switchport trunk allowed vlan 1,100,200 DLS2(config-if-range)#switchport nonegotiate DLS2(config-if-range)#exit |
| ALS1(config)#interface range fastethernet 0/7 , fastethernet 0/9 ALS1(config-if-range)#switchport mode trunk ALS1(config-if-range)#switchport trunk allowed vlan 1,100 ALS1(config-if-range)#exit |
| ALS2(config)#interface range fastethernet 0/7 , fastethernet 0/9 ALS2(config-if-range)#switchport mode trunk ALS2(config-if-range)#switchport trunk allowed vlan 1,200 ALS2(config-if-range)#exit |
Verify your configuration using the show interfaces trunk command:
| ALS2#show interfaces trunk
Port Mode Encapsulation Status Native vlan Port Vlans allowed on trunk Port Vlans allowed and active in management domain Port Vlans in spanning tree forwarding state and not pruned |
Task 3
| DLS1(config)#interface vlan 100 DLS1(config-if)#ip add 100.1.1.1 255.255.255.0 DLS1(config-if)#exit DLS1(config)#interface vlan 200 DLS1(config-if)#ip add 200.1.1.1 255.255.255.0 DLS1(config-if)#exit DLS1(config)#int loopback 0 DLS1(config-if)#ip add 192.1.1.1 255.255.255.0 DLS1(config-if)#exit |
| DLS2(config)#interface vlan 100 DLS2(config-if)#ip address 100.1.1.2 255.255.255.0 DLS2(config-if)#exit DLS2(config)#interface vlan 200 DLS2(config-if)#ip address 200.1.1.2 255.255.255.0 DLS2(config-if)#exit |
| ALS1(config)#interface vlan 100 ALS1(config-if)#ip add 100.1.1.3 255.255.255.0 ALS1(config-if)#exit |
| ALS2(config)#interface vlan 200 ALS2(config-if)#ip address 200.1.1.3 255.255.255.0 ALS2(config-if)#exit |
Task 4
When configuring HSRP MD5 authentication, you can reference a key chain, which contains the keys and key strings, or specify the key string directly with the HSRP configuration. Both methods are illustrated. The configuration on switch DLS1 has been implemented as follows:
| DLS1(config)#key chain HSRP-GROUP-ONE DLS1(config-keychain)#key 1 DLS1(config-keychain-key)#key-string ONE DLS1(config-keychain-key)#exit DLS1(config)#interface vlan 100 DLS1(config-if)#standby 1 ip 100.1.1.254 DLS1(config-if)#standby 1 priority 200 DLS1(config-if)#standby 1 preempt DLS1(config-if)#standby 1 authentication md5 key-chain HSRP-GROUP-ONE DLS1(config-if)#exit DLS1(config)#interface vlan 200 DLS1(config-if)#standby 2 ip 200.1.1.254 DLS1(config-if)#standby 2 priority 200 DLS1(config-if)#standby 2 preempt DLS1(config-if)#standby 2 authentication md5 key-string TWO DLS1(config-if)#exit |
The configuration on switch DLS1 has been implemented as follows:
| DLS2(config)#key chain HSRP-GROUP-ONE DLS2(config-keychain)#key 1 DLS2(config-keychain-key)#key-string ONE DLS2(config-keychain-key)#exit DLS2(config)#interface vlan 100 DLS2(config-if)#standby 1 ip 100.1.1.254 DLS2(config-if)#standby 1 preempt DLS2(config-if)#standby 1 priority 150 DLS2(config-if)#standby 1 authentication md5 key-chain HSRP-GROUP-ONE DLS2(config-if)#exit DLS2(config)#interface vlan 200 DLS2(config-if)#standby 2 ip 200.1.1.254 DLS2(config-if)#standby 2 preempt DLS2(config-if)#standby 2 priority 150 DLS2(config-if)#standby 2 authentication md5 key-string TWO DLS2(config-if)#exit |
Following this configuration, use the show standby commands to verify HSRP:
| DLS1#show standby brief P indicates configured to preempt. | Interface Grp Prio P State Active Standby Virtual IP Vl100 1 200 P Active local 100.1.1.2 100.1.1.254 Vl200 2 200 P Active local 200.1.1.2 200.1.1.254 |
| DLS2#show standby Vlan100 – Group 1 State is Standby 4 state changes, last state change 00:01:46 Virtual IP address is 100.1.1.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.776 secs Authentication MD5, key-chain “HSRP-GROUP-ONE” Preemption enabled Active router is 100.1.1.1, priority 200 (expires in 7.776 sec) Standby router is local Priority 150 (configured 150) IP redundancy name is “hsrp-Vl100-1” (default) Vlan200 – Group 2 State is Standby 4 state changes, last state change 00:03:23 Virtual IP address is 200.1.1.254 Active virtual MAC address is 0000.0c07.ac02 Local virtual MAC address is 0000.0c07.ac02 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 0.828 secs Authentication MD5, key-string “TWO” Preemption enabled Active router is 200.1.1.1, priority 200 (expires in 8.452 sec) Standby router is local Priority 150 (configured 150) IP redundancy name is “hsrp-Vl200-2” (default) |
Task 5
To complete this task, you need to configure HSRP tracking so that the priority of switch DLS1 is decremented to a value less than 150 when Loopback0 is disabled – allowing switch DLS2 to assume primary gateway functionality. This task is completed as follows:
| DLS1(config)#track 500 interface loopback 0 line-protocol DLS1(config-track)#exit DLS1(config)#interface vlan 100 DLS1(config-if)#standby 1 track 500 decrement 51 DLS1(config-if)#exit DLS1(config)#interface vlan 200 DLS1(config-if)#standby 2 track 500 decrement 51 DLS1(config-if)#exit |
Following this configuration, use the show track command to verify object tracking:
| DLS1#show track 500 Track 500 Interface Loopback0 line-protocol Line protocol is Up 1 change, last change 00:01:51 Tracked by: HSRP Vlan100 1 HSRP Vlan200 2 |
Additionally, use the show standby commands to verify HSRP tracking configuration:
| DLS1#show standby vlan 100 Vlan100 – Group 1 State is Active 2 state changes, last state change 00:22:23 Virtual IP address is 100.1.1.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 0.908 secs Authentication MD5, key-chain “HSRP-GROUP-ONE” Preemption enabled Active router is local Standby router is 100.1.1.2, priority 150 (expires in 8.900 sec) Priority 200 (configured 200) Track object 500 state Up decrement 51 IP redundancy name is “hsrp-Vl100-1” (default) |
Test the configuration by shutting down the Loopback0 interface on switch DLS1:
| DLS1(config)#interface loopback 0 DLS1(config-if)#shutdown DLS1(config-if)# *Mar 1 00:51:16.799: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Active -> Speak *Mar 1 00:51:17.159: %HSRP-5-STATECHANGE: Vlan100 Grp 1 state Active -> Speak *Mar 1 00:51:18.627: %LINK-5-CHANGED: Interface Loopback0, changed state to administratively down *Mar 1 00:51:19.627: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to down *Mar 1 00:51:26.799: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Speak -> Standby *Mar 1 00:51:27.159: %HSRP-5-STATECHANGE: Vlan100 Grp 1 state Speak -> Standby |
Again, the show standby commands can be used to verify HSRP tracking configuration:
| DLS1#show standby vlan 100 Vlan100 – Group 1 State is Standby 4 state changes, last state change 00:01:07 Virtual IP address is 100.1.1.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.716 secs Authentication MD5, key-chain “HSRP-GROUP-ONE” Preemption enabled Active router is 100.1.1.2, priority 150 (expires in 7.720 sec) Standby router is local Priority 149 (configured 200) Track object 500 state Down decrement 51 IP redundancy name is “hsrp-Vl100-1” (default) |
The show track command can be used to determine the state of the tracked object:
| DLS1#show track Track 500 Interface Loopback0 line-protocol Line protocol is Down (hw admin-down) 2 changes, last change 00:01:42 Tracked by: HSRP Vlan100 1 HSRP Vlan200 2 |
Task 6
Given the topology, the maximum diameter in any given situation would be 4. There are two ways the diameter can be influenced. These two methods are:
- Manually configuring STP parameters to force a diameter of 4
- Using the Cisco IOS macro to specify the diameter
The first method entails performing manual calculations using one of the following formulas:
Diameter = (Max Age + 2 – (4 * Hello)) / 2 or Diameter = ((2 * Forward Delay) – (4 * Hello)) / 3
The second method entails using the Cisco IOS macro, enabled by issuing the spanning-tree vlan <number> root primary diameter <2-7> global configuration command. The simplest method is to use the IOS macro on switch DLS1 which will be the root bridge for both VLANs.
| DLS1(config)#spanning-tree vlan 100 root primary diameter 4 DLS1(config)#spanning-tree vlan 200 root primary diameter 4 |
When the diameter is changed, default STP timers are also adjusted. Use the show spanning-tree commands to verify the configuration:
| DLS1#show spanning-tree vlan 100
VLAN0100 Bridge ID Priority 24676 (priority 24576 sys-id-ext 100) Interface Role Sts Cost Prio.Nbr Type |
Using the manual method, we could confirm this calculation as follows:
Diameter = (Max Age + 2 – (4 * Hello)) / 2
Diameter = (14 + 2 – (4 * 2)) / 2
Diameter = (16 – 8)) / 2
Diameter = (8)) / 2
Diameter = 4
The same result would be obtained using the alternate formula.
The final task is to ensure that switches ALS1 and ALS2 can ping each other. This requires that both switches be configured with default gateways (HSRP VIPs).
| ALS1(config)#ip default-gateway 100.1.1.254 |
| ALS2(config)#ip default-gateway 200.1.1.254 |
Finally, verify connectivity using a simple ping:
| ALS1#ping 200.1.1.2
Type escape sequence to abort. |
| ALS2#ping 100.1.1.2
Type escape sequence to abort. |
Final Switch Configurations
DLS1
|
DLS1#term len 0 Current configuration : 4851 bytes DLS1# |
DLS2
|
DLS2#term len 0 Current configuration : 4573 bytes DLS2# |
ALS1
|
ALS1#term len 0 Current configuration : 1139 bytes ALS1# |
ALS2
|
ALS2#term len 0 Current configuration : 1135 bytes ALS2# |