CCNP SWITCHING

Packet Forwarding:
Networking Fundamentals
* The primary function of the network is to enable communication between devices. So that the devices
can exchange information efficiently.
* There are many protocols some of them or device specific or the preferred open standard.
* Communication may include sending emails, Browsing websites, Videos conferencing, Streaming
videos, File sharing, Cloud computing.
* TCP is a standard protocol suite, OSI model is conceptual framework for understanding networking.
* OSI has seven layers, each OSI layer works independently and each layer describes specific function.
* Changes made on one OSI layer do not affect the other layers
* Data travels down the OSI stack during transmission (encapsulation), up the stack at the destination
(Decapsulation)
* Encapsulation is the process of adding protocol information as data moves down the OSI stack.
* Decapsulation is the process of removing protocol information as data moves up the OSI stack.
* OSI model allows devices from the different vendors to communicate.
* Each layer communicates and perform specific function only with layers directly above or below it.
* Functions of each OSI layer
* Application – Provides network services to application – web browser, Email client, File
transfer.
* Presentation – Data formatting, Encryption, compression
* Session – Establishes and manages communication sessions
* Transport – Ensure reliable data delivery and segmentation.
* Network – Routes packets using logical addressing (IP address). – Router. – IP address.
* Datalink – Delivers frames using MAC addresses. – Switch/Bridge. – MAC address
* Physical – Transmits the bits over physical medium. - converts digital information into signals.
* At Layer 3, host decides whether information needs to be sent to another application on the same device
or on the different device.
* If it is on the same device data moves up the stack. If it is on the different device data moves down the
stack till Layer 1.
* L1 is responsible to send the information over physical media.
* As network speed increased ASICs were developed, It is a dedicated hardware chip designed for Very
fast forwarding, high throughput.
* MLS combines the functionality of both switch and router.
Layer 2 Forwarding
* Layer 2 forwarding operates at Datalink layer.
* Data link layer is responsible for physical addressing.
* It is responsible for forwarding frames within same network segment.
* It uses MAC address to identify the devices on the same network.
* Layer 2 ensures that the information is reaches to the correct destination on the local network.
* Whenever device sends the data, it includes source and destination MAC address to the network packet.
* MAC address is a unique hardware address assigned to a NIC card.
* MAC address is a 48-bit address defined in hexadecimal format. Splits into 6 octets
* First three octets assigned to manufacturer (OUI), Last three octets are assigned uniquely by
manufacturer to device NIC. MAC address must be globally unique.
* If the destination MAC matches the device, The device removes the Layer 2 header and moves the
packet to L3 for IP processing. This process is called decapsulation.
* Network broadcast frame with MAC FF:FF:FF:FF:FF:FF MAC address sends to every device on the
local network.
* Switch forwards this frame to all ports except the one it was received.
* Broadcast is used when the switch does not know the MAC address of the Source and destination
devices in the same network. (ARP broadcast).
* Ethernet and wireless technologies identify devices using MAC address.
* Different L2 technologies use different addressing. Frame-relay uses DLCI, ATM uses VPI/VCI (Virtual
circuit identifiers).
* Switch Operates at Layer 2.
* Switches maintain the MAC address table to forward frames.
* Broadcasts are limited to single LAN segment. Layer 3 devices do not forward L2 broadcast frames to
other networks.
* If L2 broadcasts are sent from one LAN to another LAN would create excessive unnecessary traffic.
Network performance would suffer.
Collision Domain
* A collision occurs when two or more devices transmit data at the same time on the same shared network
medium.
* Collision may also occur when signal overlap, transmitted data becomes corrupted,
* Collision domain is a part of the network where the devices share the same communication medium.
* Collision domain is a network segment in which only one device can transmit the data at a time. In this
segment, Device can detect if another device is transmitting the data.
* Ethernet is a shared medium, only one device could transmit the data at a time, simultaneous
transmissions caused collisions.
* To solve this problem, ethernet introduced CSMA/CD.
* CSMA/CD is a Carrier sense multiple access with Collision Detection.
* CSMA/CD ensures that only one device transmits the data at a time.
* In CSMA/CD
* Device first listens to the network before transmitting data.
* If Medium is busy, wait until quiet.
* Every device has equal rights to the shared medium. Any device may transmit when the
medium is free.
* If sometimes may collision occurs due to two or more devices start transmitting the data nearly
same time, the devices who transmits the data detects it and stops transmitting the data. Waits for
random amount of time and then try again.
* In CSMA/CD, Devices operates in half-duplex mode.
* In Half-duplex mode – device can only transmit or receives data, But not both at the same time.
* Thinnet (10Base-2) and Thicknet (10-Base-5) Technologies used co-axial cables. All the network
devices use the same co-axial cable and T connectors (Single collision domain)
* Adding more devices to the network reduced efficiency (more waiting time, more collision).
* Later, HUBs increased port density but worsened collisions.
* HUBs repeat traffic to all ports, every device in the HUB is in the same collision domain.
* HUB are no intelligent devices.
* Later switch was introduced to increase scalability and stability creating separate collision domains per
port in the network.
* Switch operates at Layer 2 and learns MAC addresses and maintains a table mapping devices to ports.
* Switch forwards frames only to the correct port.
* Switch improves efficiency by creating virtual channels between communicating devices.
* Switch enables full-duplex communication. Simultaneous transmit and receive.
* Benefits of switch are no collisions, Higher speed, better performance.
* Switch performs unknown unicast flooding when the destination MAC is unknown. Forwards packet to
every switch port, except the port that the packet was received on.
* Broadcast traffic is sent to all devices in a network. Switches forward broadcast out of all active ports.
* Broadcast domain is a segment is the det of devices that receives a Layer 2 broadcast.
* All devices connected to the same switch are in the same broadcast domain.
* Excessive broadcast reduces efficiencies of the switch by interrupting unicast communication between
network devices.
* Broadcast do not cross L3 boundaries. Routers separate broadcast domains.
CSMA/CA – Carrier Sense Multiple Access/ Collision Avoidance
* CSMA/CA is a network access method used in wireless networks to avoid collisions before they
happen.
* Wireless network devices can not detect collisions while transmitting.
* CA avoids collisions proactively instead of detecting them later.
* Device listens to the channel before transmitting. Waits for short time depending on the traffic priority.
* Device waits a random time to reduce simultaneous transmissions.
* If channel is still Idle, the device sends the frame.
* Receiver confirms successful delivery, If no ACK, sender assumes collision and retries after exponential
backoff.
* RTS and CTS are the optional enhancements
* Sender requests permission with RTS, AP replies with CTS – reduces hidden node collision.
* RTS and CTS often disabled for small packets due to overhead.
VLANs – Virtual LANs
* Virtual LANs provide logical segmentation of the network. VLANs create multiple broadcast domains
on the same physical switch.
* VLANs improve hardware utilization by assigning ports to specific VLANs.
* Devices in a different VLANs cannot communicate directly without a router or L3 switch.
* Broadcast frame from one VLAN cannot reach the another VLAN.
* VLANs provide
* L2 security.
* Less broadcast traffic
* Better performance
* Better port utilization
* VLANs are defined in IEEE802.1Q standard. Switch inserts a VLAN tag into the frame.
* VLAN tag is a 4-byte (32-bit) long. It is added when ethernet frame is traversing trunk links.
* It contains four fields.
* Tag protocol identifier (TPID): It is 16-bits in length. Value is set to 0x8100. This field is used
to identify the frame as an 802.1Q tagged ethernet frame.
 * Priority code point (PCP): It is 3-bits in length. This field indicates Class of Service for L2 QoS
between switches. High priority traffic can be forwarded before low priority traffic.
* Drop Eligible Indicator: It is 1-bit in length. This field indicates whether frame may be dropped
during network bandwidth congestion.
* VLAN ID: It is 12-bits in length. This field specifies the VLAN associated with a network
packet.
* VLAN identifier has only 12-bit which provides 4094 possible VLANs.
* VLAN 0 is reserved for 802.1p traffic and cannot be modified or deleted.
* 802.1p is L2 QoS standard that allows switches to prioritize network traffic.
* VLAN 1 is default VLAN and cannot be modified or deleted.
* VLAN 2 to 1001 are normal VLAN range and can be created, modified or deleted as necessary.
* VLAN 1002 to 1005 are reserved for legacy technologies and cannot be deleted.
* VLAN 1006 to 4094 are in the extended VLAN range and can be created, modified or deleted.
* vlan <vlan-id> - global configuration command is used to configure VLANs.
* name <vlan-name> - Vlan sub mode configuration command is used to create a name.
* A Vlan is created after exit VLAN config mode or create another VLAN.
* show vlan [{brief | id <vlan-id> | name <vlan-name> | summary}] – command is used to verify the
VLANs and their port assignments.
* Output provides VLAN-to-Port assignments, System MTU, SPAN sessions, and private
VLANs.
* brief – Displays only VLANs with their assigned ports.
* summary – Displays a count of VLANs, VLANs participating in VTP, and VLANs that are in
the extended range
* if <vlan-id> - Displays all the output from the original command only for specified VLAN.
* name <vlan-name> - Displays output for only specified VLAN name.
* VLAN headers are added for only packets that are sent across on trunk ports.
Access Port
* An access port is a switch port that belongs to only one VLAN. It cannot carry multiple VLANs.
* Access port connects to end user devices such as PCs, Laptops, Printers, Servers, IP phones.
* Access port carries traffic for one VLAN only and sends/receives frames without VLAN tags.
* By default, all the switch ports considered as Access port and assigned to VLAN 1.
* switchport mode access – command is used to manually configure switchport as an access port.
* switchport access vlan (<vlan-id> | name <vlan-name>) - command is used to associate specific
VLAN to the switchport.
Trunk Port
* Trunk port is a switchport that can carry traffic from multiple VLANs over the single physical link.
* Trunk ports are used to connect with switch – switch, switch – router, switch – firewall, switch –
wireless AP, Switch – ESXi server.
* Frames are tagged with 802.1Q headers when sent across the trunk links.
* VLAN tagging ensures proper VLAN separation across devices.
* Once the frames are received at destination, device examines the VLAN tag, associates traffic with
correct VLAN, removes the tag before forwarding to the destination port.
* VLAN tag tells the destination device exactly which vlan the frame belongs to.
* switchport mode trunk – Command is used to configure trunk on switchport.
* show interface trunk – Command is used to verify the trunk configuration.
* This command is very useful in troubleshooting connectivity between network devices.
* The output of the command provides three key sections.
* Trunk Interfaces – List of all trunk ports and their status, Native VLAN
* Native VLAN is the VLAN whose frames are normally sent without an 802.1Q tag.
* Allowed VLANs – List of allowed VLANs on trunk port. Vlans can be restricted on trunk ports
to specific switches.
*This reduces unnecessary broadcast traffic, reduce traffic on trunk ports and improves
security. Improves efficiency.
* Can be used for load balancing between network links by selecting one set of VLANs
on one trunk link and other set of VLANs on another trunk link.
* Forwarding VLANs – Displays list of VLANs currently in forwarding state.
* Ports/VLAN are blocked by STP will not appear here because VLAN is not forwarding
on trunk.
* Virtualized environments also rely heavily on trunk ports for VLAN separation.
Native Vlans
* A Native vlan is the vlan whose frames are sent without an 802.1Q VLAN tag over a trunk port.
* On an 802.1Q trunk, traffic belonging to the native VLAN is transmitted and received untagged.
* Vlan 1 is the default VLAN.
* switchport trunk native vlan <vlan-id> - command is used to change the Native vlan. This command
is interface specific.
* Traffic transmitted or received on a trunk port without an 802.1Q tag is associated with the native
VLAN.
* A host connected in access port VLAN 10 can communicate with a host connected to a trunk port who’s
native VLAN 10. This works due to no VLAN tag is added on either port.
* All the Switch control plane traffic is advertised using VLAN 1.
* Cisco hardening guidelines recommend
* Changing the native VLAN to something other than VLAN 1.
* Use the VLAN that has no host attached.
* It prevents attackers from exploiting VLAN 1 for control-plane traffic. Reduces the risk of VLAN
hopping attacks and accidental traffic mixing.
* Native VLAN must match on both ends of the trunk link.
* Misaligned native VLANs can cause connectivity issues and security risks.
Allowed VLANs
* By default, Trunk links carry all available VLANs between devices. (except reserved VLANs)
* Administrators can restrict VLANs on a trunk port to control traffic flow.
* Allowed VLANs list lets administrator to specify which VLANs are permitted.
* Restricting VLANs helps with traffic engineering and reduces unnecessary broadcast traffic, improves
security, Reduce MAC address flooding, provide load balancing and improves efficiency, saves
bandwidrh.
* Misconfiguration can cause connectivity issues if expected VLANs are not allowed on the trunk.
* If VLAN is restricted on Trunk link
* Unknown unicast frames are not flooded across the trunk
* Broadcasts are also not forwarded across the trunk.
* switchport trunk allowed vlan <Vlan-id, Vlan-id> - this command is used to configure allowed
VLANs list. All other VLANs are blocked.
* Optional Keywords for this command
* all – allow all VLANs, this is default behavior.
* none – Removes all VLANs from the trunk. No VLAN traffic crosses the trunk; this option is
rarely used in production.
* add – used to allow extra VLANs to the existing list.
* remove – Removes specified VLANs from the existing list.
* except – used to allow all other VLANs except the specified ones. This feature is used rarely.
* It is recommended to use add/remove keywords while changing configuration.
* Misconfigurations can cause overwriting the entire VLAN list. It causes traffic loss for omitted VLANs.
* Show interface trunk – command is used to verify which VLANs are allowed and active on a trunk.
Layer 2 Diagnostic Commands
* There are some command diagnostic commands used for daily administration, operation, and
troubleshooting.
* MAC address table
* MAC address table is most important L2 table in a switch used for troubleshooting.
* MAC address table is used to forwards frames efficiently.
* MAC address table is a database maintained by the switch that maps
* MAC address, VLAN, switchport.
* This allows switch to forward frames only to the correct destination port instead of flooding.
* MAC address table built dynamically by examining the source MAC address of incoming frames.
* MAC address table is stored in Content address memory (CAM) for high-speed lookups.
* MAC address table is used for Faster forwarding, less unnecessary traffic, smaller collision domains,
better network performance.
* show mac address-table – Command is used to display the MAC address table. Optional Keywords
include
* address <mac-address> - used to display entries for a specific MAC.
* dynamic – shows dynamically learned MAC addresses.
* vlan <vlan-id> - Displays entries that matches specified VLAN.
* Output includes
* VLAN ID – Vlan in which the MAC was learned
* MAC address – Devices L2 MAC address
* Type – Dynamic or static
* Port – Switch interface where the MAC was learned.
* Static MAC address is a manually configured entry in a switches MAC address table. Assigned to
specific port and VLAN.
* Static MAC addresses are permanent until removed by configuration. Stays in the table even if no
traffic is seen.
* Static MAC address prevents the switch from relearning or changing the mapping.
* Static MAC address is used for
* security – binding a device to a port.
* Prevents flooding when a device doesn’t send traffic often.
* Static MAC addresses are powerful for security and stability but less flexible than dynamic learning.
* Static MAC addresses can be used for load balancing.
* mac address-table static mac-address vlan vlan-id [drop | interface | interface-id] – command is
used to add static mac address statically to specific switchport or to drop traffic.
* clear mac address-table dynamic [address <mac-address> | interface <int-id> | vlan <vlan-id>] –
This command flushes out the MAC address table for the entire switch.
* Optional keywords
* address <mac-address> - clears entry for specific MAC
* interface <interface-id> - clears entry for specific port
* vlan <vlan-id> - clear entries for a specific VLAN.
* These commands are useful during troubleshooting when a device moved to another port or stale entries
are causing confusion.
* MAC address table is stored in CAM. CAM uses high speed memory that is faster than RAM.
* RAM looks for data by an address; CAM looks up by content.
* CAM performs parallel searches across all entries at once.
* The CAM table provides binary results
* 0 – True – yes entry exists – forward to the associated port.
* 1 – False – no entry – flood the frame out all ports in that VLAN.
Switch Port status
* Verifying the switchport configuration is useful in troubleshooting.
* show interfaces <int-id> switchport – This command is used to provide all the relevant information
for a switch ports status. Displays complete L2 switchport information and operational parameters for a
specific port.
* The above command is used to troubleshoot VLAN and trunk issue.
* Key fields in the output includes
* switch port state – port is UP or DOWN – Describes if switchport is acting as L2 or L3.
* Operational Mode – Access or Trunk. This shows how the switch port is currently operating.
* Access mode VLAN – VLAN assigned if in access mode. Possible values are static access,
static trunk, dynamic desirable, dynamic auto.
* It is important to distinguish between configured settings and operational settings while troubleshooting
L2 Network.
* show interfaces switchport – This command is used to provide all the relevant information for all
switch ports status. Displays complete L2 switchport information and operational parameters for all
switch ports.
* The above command is useful when auditing entire switch.
* show interfaces status – This command is used to view short summary of all switch ports. Most
commonly used command in daily network operations.
* This command provides condensed and simplified view of port status.
* Output fields include
 * Port – Displays Interface ID or port channel
* Name – Displays the configured interface description. Helps identify connected devices.
* Status – Displays status of the interface. Key fields include
* Connected – cable connected, link established, interface operation. Link detected and
active.
* Not Connected – No Cable, Device Powering off, Cable Unplugged. Link is not
detected.
* Err-disabled – Switch has automatically disabled the port because of an error. Port does
Not forward traffic until the condition is cleared and the port is re-enabled.
* Port security violation
* BPDU Guard
* UDLD
* EtherChannel mismatch
* Link Flap
* DHCP Snooping Violation.
* VLAN – Displays link type of the link or VLAN number.
* Displays VLAN number assigned to access ports.
* Trunk link appears as trunk.
* Layer 3 interfaces display as routed.
* Duplex – Displays duplex of the port
* a-full or a-half – auto negotiated
* full – configured as full duplex
* half – configured as half duplex
* Speed – Displays the speed of the port.
* a-1000 – auto negotiated
* Type – Displays type of interface for the switchport.
* RJ-45 copper port – 10/100/1000BASE-TX
* Small Form Factor pluggable (SFP) – Displays SFP model (SFP-10GBase-SR).
* unknown –There are no drivers installed or module is not detected.
L3 Forwarding
* There are two methods for layer 3 forwarding
* Forwarding traffic to devices on the same subnet
* Forwarding traffic to devices on the different subnet
* The devices belong to same subnet communicate locally. – LAN.
* The device detects destination network with the help of packet headers. (Src IP, Dst IP, Src MAC, Dst
MAC)
* Packet headers are the control information placed at the beginning of a network data packet that
contains instructions on how network hardware and software should route, process and reassemble the
transmitted payload.
* Devices forwards packets to the destination on the same network with the help of L2 header (Source
MAC and destination MAC) information which will be added to the packet headers.
* ARP (Address resolution protocol) is used to map IP address to MAC address.
* Device uses ARP table to add L2 header to the packet before sending it down to the OSI for forwarding
packet to the destination. (Initially device do not know destination MAC).
At initial communication process,
* Source host sends ARP request to entire L2 switching segment (ARP broadcast).
* Destination host with matching IP reply to the ARP (unicast) includes IP address and MAC address.
* Source Host receives ARP reply then updates its local ARP table.
* Source host adds L2 headers and sends data packet for processing and forwarding.
ARP table contains
* Recent communication entries for devices and hosts.
* Entries for the devices in the same network and gateway information to reach the different network.
* ARP entry removed if the communication not occurred for given length of time.
* Show ip arp: command is used to view the ARP table.
keywords [mac-address | IP-address | vlan vlan-id | interface-id] are used to filter the
information.
Packet Routing
* Routing is the process of sending packets to the destinations in the different network.
* The device detects destination network with the help of packet headers by seeing IP address.
* The router checks its routing table to identify the gateway to send packets to different network.
Routing table learned from: Static route entry. it can get the destination network, subnet mask, next-hop
IP. Static default route, used for all non-local traffic and Dynamic routing protocols such as (RIP, EIGRP,
OSPF).
* Source device must add L2 headers (Source and Destination MAC addresses).
* Device looks for destination MAC in ARP entry. MAC addresses must be the next-hop interface.
* Device adds packet headers and sends down to the layer 1 for processing and forwarding.
* Adjacent router receives packet, analyzes the destination IP, locates network entry in routing table,
identifies the outbound interface, finds MAC address for destination device. Router modifies the source
MAC address to the MAC address of the routers outbound interface and modifies to the destination
MAC-address for the destination device.
* This process continuous on and on until packet reaches the destination.
IP address assignment
* TCP is standard protocol for most of the networks.
* IPv4 is a 32-bit address
* To deal with increase in the demand of public IP addresses IPV6 has developed.
* IPv6 is a 128-bit address.
* IP address is used to communicate devices in network.
* Ip address <ip-address> <subnet-mask>: command is used to assign IP address to an interface.
* An active interface with the valid IP address injects network into routing table.
* Connected networks have AD value is 0.
* Ip address <ip-address> <subnet-mask> secondary: We can configure multiple IPv4 networks to
same interface.
* ipv6 address [ipv6-address|prefix-length] : this command is used to assign IPv6 address to an
interface
* To assign multiple IPv6 addresses, same command needs to be repeated multiple times.
* ipv6 address 2001:db8:10:172::254/64
* ipv6 address 2001:db8:20::254/64
Routed subinterface:
* Routed sub-interfaces are required when there are multiple VLANs on a switch and require routing,
instead of using dedicated physical interface per VLAN.
* Create a trunk port on the switch and create a logical subinterface on the router.
* interface gig0/1.1: This command is used to create a logical subinterface on the router.
* encapsulation dot1q <vlan-id>: this command is used to associate the VLAN with the subinterface
* The subinterface number doesn’t have to match the VLAN ID, but if it does it helps with operational
support.
Switched Virtual Interface (SVI)
* Switched virtual interface (SVI) is also called as VLAN interface.
* SVI is configured as: define L2 vlan then define vlan interface
* Interface vlan <vlan-id>: command is used to create SVI on the switch.
* The switch must have an interface associated to the L2 vlan in an up state for the SVI to be an up state.
* Switch connected to a router may need routing.
* No switchport: command is used to convert L2 switchport to a routed switch port. The IP address can
be assigned to the routed interface.
* Show ip interface [brief | interface-id | vlan<vlan-id>]: IP address can be viewed with this command
* OUTPUT displays MTU, DHCP relay, ACLs, and the primary IP address.
* Show ip interface brief
* Show ip interface brief | exclude unassigned
* Show ipv6 interface [brief | interface-id | vlan vlan-id]: information can be viewed for IPv6
addresses.
* Show ipv6 interface brief | exclude unassigned
Forwarding Architectures
* In early days when Cisco routers receive packet, It removes the L2 information and verify the route.
* If route found invalid, packet is dropped.
* If Route found valid, Router identify the route in its routing table and add new L2 header information.
* In Advance terminology, Routers do not remove and add the L2 addressing but it simply rewrites the
addresses.
* IP packet switching is a faster process of receiving IP packet on an input interface and making a
decision about whether to forward the packet to an outbound interface or to drop it. this process is also
known as IP packet forwarding.
Process Switching
* Process switching is also called as software switching or the slow path.
* The general-purpose CPU handles packet forwarding.
* Ip-input process runs on the general-purpose CPU for processing incoming IP packets.
* Ip-input process consults the RIB and ARP table to determine the next-hop
* Ip-input process is designed to handle a very small percentage of traffic.
* This method is fallback to CEF and it is dedicated to process punted IP packets.
* This process generally used for
* Packets sourced or destined to the router using control traffic or routing protocol.
 * IP packets with IP options – packets that are too complex for the hardware to handle.
* Packets that require extra information that is not currently known (unresolved ARP entries)
* Software switching is slower than hardware switching.
* Process switching do, overwriting dst/src MAC, Decrementing TTL, Recomputing IP header checksum.

Fast Switching
* Fast switching is introduced to improve performance
* This method uses a cache of previously forwarded packets
* First packet is process switched, subsequent packets for the same flow are forwarded using cached
information.
* Faster than Process switching but limited in scalability.
Cisco Express Forwarding (CEF)
* CEF is a cisco proprietary switching mechanism.
* It is default and most efficient forwarding method in modern cisco platforms.
* It is designed to handle high packet throughput.
* It provides scalability, stability and speed for high-volume traffic.
* It is a default switching mechanism used in all cisco platforms that runs on specialized hardware such as
(ASICS, NPU) for high packet throughput.
* In Software-based routers CPU is in-charge for all operations including CEF switching.
* Hardware-based routers use forwarding engines (implemented in ASICS, NPUs, TCAM).
* Forwarding engines provide the packet switching, forwarding, and route lookup capability to routers.
* If CEF can not handle the packet, it punts it back to process switching.
* Software CEF: runs on CPU in software-based routers. CPU performs all forwarding operations.
Including FIB lookups and adjacency rewrites.
* Hardware CEF: runs on specialized forwarding engines in hardware-based routers.
* IT uses ASICS, NPU, TCAM for high packet throughput, high speed lookups and packet forwarding.
* CEF handles large volume of traffic efficiently
* Reduces CPU load and prevent from bottle necks.
Ternary Content Addressable Memory
* TCAM is backbone of the modern forwarding architecture like CEF.
* TCAM is an extension of the CAM architecture. It extends simple CAM model by allowing more
flexible matching.
* It is a specialized memory used in cisco platforms.
* TCAM allows routers and switches to perform upper layer processing such as identifying L2/L3 src/dst
addresses, Protocols, QoS markings, complex forwarding’s, security and etc.
* TCAM provides more flexibility searching than CAM does, which is only binary.
* TCAM provides three outcomes – 0 – True, 1 – False, X – Don’t care (Wildcard). It is called as Ternary
Combination.
* TCAM entries are stored in VMR format.
* Value (V) – This indicates the field should be searched – IP address, Protocol
* Mask (M) – this indicates the field that is of interest and that should be queried.
* Result (R) – This indicates Action taken when match occurs – Forward, Drop, Apply QoS etc.
* TCAM allows multiple actions beyond forwarding
* Redirecting traffic to QoS policer, Apply QoS shaping, Point to different entry in forwarding
table
* TCAM operates in hardware providing faster processing and scalability
* TCAM space is limited; Memory allocation must be balanced between ACLs, QOS and forwarding
functions.
* Most of the cisco platforms implement multiple TCAM entries, so that inbound/outbound security, QOS
and L2/:3 forwarding decisions occur all at once.
* This allows ACLs to process at same speed regardless of count.
Centralized Forwarding
* All the packet switching decisions are made by the Route processor.
* In centralized architecture RP processor equipped with Forwarding engine, both combine makes all
packet switching and forwarding decisions
* Line cards do not make forwarding decisions. they simply forward packets to RP.
* When Packet arrives at the ingress line card, it sends packet to the RP.
* Forwarding engine in the RP examines the packet header, finds the destination in the forwarding table,
* Decides which output interface should send the packet
* RP sends packet to the egress line card.
* The egress line card transmits the packet.
Distributed Forwarding
* Distributed forwarding is used in high-performance routers and switches. in this architecture each line
card has its forwarding engine.
* Forwarding decisions are distributed across hardware, instead of relying on central CPU.
* Packet enters on an ingress line card, then it is transmitted to the local forwarding engine, bypass RP.
* Forwarding engine checks Destination IP and Routing table / FIB (Forwarding information base) ACLs,
QoS etc.
* If the outbound interface is on the same line card, it simply forwards packet to the port. Low latency.
* If the outbound interface is located on the different line card, the packet is sent across to the switch
fabric (Backplane)
* Switch fabric connects line cards at high speed. Packet goes directly to the egress line [Link] passes
the RP.
* RP only Builds routing table, pushes forwarding information base to all line cards.
Software CEF
* Software CEF is also called as software forwarding information base (FIB). it’s a software-based
implementation of cisco express forwarding.
* Software CEF consists of Forwarding information base FIB, Adjacency table (AIB).
* These two tables help CEF to forward packets fast and with high throughput. avoid repeatedly
consulting the routing table and ARP lookups for every packet.
* FIB Built directly from the RIB. FIB contains next-hop IP address for each destination in the network.
* FIB keeps a mirror image of the forwarding information contained in the routing table.
* FIB updated automatically whenever routing (Topology) changes occur.
* FIB performs fast, prefix-based lookups, CEF uses FIB to make routing decisions. to identify the next-
hop information.
* AIB contains L2 information needed to forward the packets such as
Directly connected next-hop IP address and their MAC address., Local egress interface MAC address,
Link-layer encapsulation information
* AIB built using ARP table for IPV4 information, Neighbor discovery for IPV6 information, Other L2
protocols such as frame-relay, PPP.
* FIB determines Next-hop IP - routing
* AIB determines next-hop MAC and its interface.
* FIB uses adjacency pointers to link to Layer 2 information.
Process for how CEF table built from the routing table
First FIB table build from the routing table, Finds best destination prefix, determines next-hop IP, Points
to adjacency table entry. AIB is built using ARP table, Provides MAC address + Egress interface.
Switches the packet out to the correct interface with proper L2 header
Once the packet is received, FIB checked for valid entry
If entry is missing, it is a glean entry, packet go through the CPU as CEF is unable to handle it.
If entry found, Process continued by looking for the valid adjacency entry based on FIB record.
if adjacency entry is missed, it invokes the ARP process. complete CEF entry will be created after ARP is
resolved.
* It follows packet forwarding process and rewrites the packet headers as needed.
* CPU subject to a rate limiter for invalid or incomplete adjacency to prevent the starving of CPU cycles.
* TTL is L3 loop prevention mechanism that reduces TTL by 1 for every L3 hop. TTL 0 packets will be
discarded.

Hardware CEF
* Hardware CEF is a hardware-accelerated Cisco express forwarding.
* Routers with Hardware CEF contains below hardware in line cards
ASICs - application specific integrated circuits, NPU - network processing units
* These components perform packet forwarding at extremely high speed. deterministic performance,
support huge forwarding rates.
* ASICs hardware-based routers are expensive to design, manufacture and troubleshoot.
* ASICs are hardwired (build directly into the hardware) they cannot easily change behavior. cannot be
changed without redesigning the chip.
* Troubleshooting is harder because behavior is fixed in silicon
* ASICs are extremely fast but they are limited in their functionality as they are hardwired to perform
specific tasks.
* To overcome the limitations and inflexibility
* NPU is a programmable processor optimized for networking
* NPUs are slower than ASICs but programmable
* Software/Firmware updates can change forwarding behavior.
* Allows routers to support new features, protocols, and policies. RP
* ASIC and NPU together provide Flexibility, high throughput.
* Distributed CEF is the forwarding mechanism used in distributed forwarding architecture.
* CEF tables are downloaded by the RP to every line card.
* Line cards use their ASICs and NPUs to forward packets
* No forwarding decisions pass through RP.
Benefits
* High throughput - every line card forward packets in parallel.
* Scalable - Adding more line cards are equal to adding more forwarding engines.
* RP handles only control plane, routing protocol, FIB population. Forwarding stays distributed.
* d CEF flow
RP builds routing table
RP built CEF table (FIB + Adjacency)
CEF tables are pushed to all line cards
Each line card downloads CEF data into its ASICs and NPU
Line cards handle forwarding independently
Local forwarding - if egress interface on same line card
Else - send via switch fabric - egress line card.
SDM Templates
* SDM (Switching database manager) templates are profiles that determine how switches TCAM
resources are allocated for different functions.
* TCAM is used to store MAC address table, Routing tables, ACLs, QoS tables, Security entries
* TCAM is limited, and some features need more TCAM than others depending on the switches role
* SDM templates allow us to pick the resource allocation profile that best fits the deployment.
* Memory used for TCAM tables are limited and statistically assigned during the boot sequence of the
switch.
* If a table is full, the switch cannot install new entries in hardware
* Sends overflow traffic to the CPU
* Causes performance issues on the switch or dropped packets
* SDM templates help prevent this by choosing the right balance between
Number of MAC addresses, Number of IPv4/IPv6 routes, Number of ACL entries, QoS resources,
Multicast entries
* Capacity of the MAC addresses switch needs compared to the number of routes the switch holds
depends on where the switch is deployed.
* SDM templates are used to modify the Allocation ratios of the TCAM tables.
* SDM templates are varied by model
* Different roles require different allocations
* SDM templates are used in access, distribution and core switch and tune the allocations accordingly.
* Access layer switch needs more MAC and fewer routing entries.
* Distribution and core switch needs more routing entries and fewer MAC addresses.
* SDM templates define ratios for IPv4/IPv6 routes, VLANs, MAC address table size, security entries,
NetFlow entries, ACL hardware entries.
* Switch stores the chooses profile once apply SDM templates.
* Switch must be reboot to reallocates TCAM resources after applying SDM templates.
* SDM templates on 9300 follows
Default, vlan, advanced, wireless, routing, access, uplink-heavy
* SDM prefer vlan
Large vlan environment, large MAC tables, Access-layer switching, minimal routing

* SDM prefer advanced

More IPv4/IPv6 routes, More ACL entries, Distribution layer forwarding, security features
* Choosing the wrong SDM template can cause memory exhaustion. traffic punted to CPU performance
drops
* Show sdm prefer - command is used to view the applied SDM template.

SPANNING TREE PROTOCOL

* STP - provides overview of how switches detect each other and prevent forwarding loops.
* RSTP - provides improvements made to STP for faster convergence.
Spanning-tree Fundamentals
* Modern networks include redundant links between switches to avoid link failure
* Redundant links may introduce major issues such as
* Broadcast storms. Switching loops occur as multiple paths exist - switch do broadcast or
unknown unicast floodings when destination MAC address is unknown.
* Network broadcast forward in a continuous loop and link becomes saturated, and the switch is
forced to drop packets.
* Constant MAC table updates - MAC address table constantly change ports due to packet loops.
* Switches learn same MAC address on multiple ports due to loops.
* Ethernet has no TTL field - packets continue loop around the topology
* High Memory/CPU utilization.
* So, Switches use STP/RSTP to prevent forwarding loops while allowing redundant links.
* STP prevents layer 2 loops in switched networks.
* Switches use BPDU (bridge protocol data units) packets for
* To discover neighboring switches.
* To elect Root bridge.
 * To determine best loop-free paths – Loop prevention
* To block unnecessary redundant links.
* To carry port roles and states.
BPDU messages contain
* Root bridge ID, Sender Bridge ID, Path cost to root, Port ID, Message age, MAX age, Hello
time, Forward delay.
* STP ensure that the network has a physical redundancy, logically behaves like loop-free topology.
* STP temporarily blocks traffic on redundant link to provide loop free topology.
* STP runs a tree-based algorithm by electing one switch as a best switch.
STP types are
* 802.1D - STP - slow convergence - 30-50 seconds
* PVST- Runs separate STP instance per VLAN, Allows different root switches for different
VLAN
* PVST+ -Supports 802.1Q trunking, interoperates with IEEE STP, widely used on catalyst
switches.
* 802.1W - RSTP - Faster convergence, Simplified port roles and states, Backward
compatible with 802.1D.
* 802.1S - MST - RSTP based internal operation. more scalable than PVST+ for large
environments, Group Many VLANs into single STP instances.
802.1D
* STP ensures loop free topology for one VLAN
* Switchport goes through several states before it is allowed to forward traffic. this ensures the network is
stable before the port becomes active by preventing loops.
STP states
* Disabled - Port is admin down, It does not participate in STP, No traffic is sent or received.
* Blocking
* The port is active, but not forwarding traffic.
* This state ensures that the loop is not created in topology
* Switch does not send user data frames
* Switch can only receive BPDU packets
* it does not modify the MAC address table.
* Listening
* Switch can send and receives BPDU packets
* Switch doesn’t forward any network traffic
* does not learn MAC addresses.
* Duration of the state is correlate to the STP forwarding time.
* Learning
* The switch port can learn MAC address from incoming traffic.
* switch doesn’t forward any network traffic besides BPDU.
* Ensures switch builds a correct MAC address table before forwarding traffic.
* Duration of the state is correlate to the STP forwarding time.
* Port does not immediately start forwarding traffic, must pass through intermediate states (Listening,
Learning)
time spent each of these states is determined by a timer called forward delay.
Total forwarding time = 30 seconds
Forwarding
* The switchport is fully operational in this state
* Switchport can forward all network traffic.
* Switchport can learn MAC address table as expected.
* Participates in BPDU exchange
* Final state for switchport to forward network traffic.
Broken
* This is a rare and vendor specific state.
* The switch has detected a configuration or operational problem on a port that can have major effects.
* The port discards packets until the issue is fixed.
* Reasons may include
* RSTP on one side, other side is running a different STP
* Inconsistent port - received BPDU is not matching the expected STP mode.
* Inconsistent STP configuration - Mismatched MST region name/version, VLAN mapping
inconsistencies, PVST/MST boundary problems.
* 802.1D STP initialization time takes about 30 seconds for a port to transition from a blocking to a
forwarding state using default timers
802.1D port types
* Every switchport takes one of three roles based on STP calculations.
* There are three port-types in STP
* Root port (RP)
* The port that connects to the root bridge or an upstream switch in the spanning tree topology.
* There should be only one root port per VLAN on a switch.
* single port on a non-root switch that provides best path to the root bridge.
* Root switch has no root ports
* Root port always in forwarding state
* Receives BPDUs that are originating from the root bridge.

Designated port (DP)

* STP ensures loop-free, efficient forwarding of traffic with in a network.
* DP is the active forwarding port for network segment.
* Designated port is responsible for forwarding frames towards downstream devices (Hosts or Switches)
* DP receives and forwards BPDU frames to other switches. These messages help to maintains a loop-
free topology.
* Only one DP must be chosen for the link.
* DP will be elected as
* The switch with the lowest path cost to root bridge
* Switch with the lowest bridge ID
* The port with the lowest port ID.
* All ports on the Root bridge are always DP as root bridge is the central point of the STP topology.
Blocking Port
* Blocking port does not forward user traffic.
* Blocking port receives BPDUs (Bridge protocol data units). These messages help STP to detect
topology changes.
* Blocking port does not learn MAC addresses, Does not forward user data frames, Does not forward
BPDUs towards the network.
* Blocking port stays in passive listen-only mode.
* Switch port does not win RP or DP is placed into Blocking state.
STP key terminology
Root bridge
* It is a central and most important switch in a STP layer 2 topology. Exist at top of the topology.
* Root bridge serves as reference point for the all STP path and cost calculations across the network.
* All ports on the root bridge are always in forwarding state.
* All active ports on the root bridge are classified as DP.
* Root bridge is elected based on lowest Bridge ID (Priority + MAC address).
BPDU (Bridge Protocol Data units)
* BPDU is a special L2 control packet used by switches to build, maintain, and update STP topology.
* Used to identify the root bridge.
* Elect root ports and designated ports.
* Determine which port must be blocked to prevent loops.
* Detect topology changes in the L2 network.
* Uses the multicast destination MAC - 01:80:c2:00:00:00
* There are two types of BPDU
* Configuration BPDU
* Configuration BPDU is used to identify the root bridge, root port, designated port, and blocking ports.
* Configuration BPDU contains
STP Type - Protocol version
Root path cost - distance to root bridge
Root bridge identifier - Bridge ID
Local bride identifier - senders ID
Max age - how long BPDU is valid
Hello time - BPDU transmission interval
Forward delay - listening + learning time
* TCN - Topology change notification BPDU
* TCN BPDU is used to communicate topology changes to other switches such as
port up/down
link failure
switch add or remove
* A non-root bridge sends TCN BPDU towards root bridge
* Root bridge Acknowledges by sending configuration BPDU with the topology change bit set.
* switch reduces MAC aging timers to quickly flush outdated entries. this ensure rapid convergence after
topology changes.
* Root path cost
* it is a total cost of the path from a switch to root bridge
* each link has its own associated cost based on bandwidth
* Switches add the cost of each link along the path to calculate the full root path cost.
* path with Lower path cost to the root is preffered.
* System priority
* It is a 4-Bit value used as part of Bridge ID in STP
* Default system priority is 32768
* Lower value increases the change of becoming root bridge
* Priority can be manually changed.
* System ID extension
* It is a 12-bit field appended to the bridges STP priority.
* It represents VLAN id for the BPDU
* Bridge priority + System ID extension = Extended bridge ID.
* Used in PVST+ and Rapid PVST+ to maintain unique BPDU information per vlan.
* Root bridge identifier
* Root bridge ID is used to identify the selcted Root bridge in the network.
* Root bridge ID is a combination of
Root bridge system priority
Root bridge system ID extension (VLAN ID)
Root Bridges MAC address
* Local bridge Identifier
* Local bridge ID identifies the switch itself
* Switches compares root bridge ID with their local bridge ID to determine whether they are root or not.
* Local bridge ID is a combination of
Local switch system priority
Local switch system ID extension
Local switch system MAC address
* MAC age
* MAX age timer determines how long a switch keeps BPDU information before discarding it.
* Default value is 20 seconds
* spanning-tree vlan <vlan-id> mac-age <maxage>
command is used to configure max age timer value.
* If a switch stops recieving BPDU, it assumes BPDU still valid for the duration of MAX age timer.
* Hello time
* Hello time is the interval at which the root bridge sends BPDU
* Default vlaue is 2 sec
* spanning-tree vlan <vlanid> hello-time <hello-time>
command is used to set the hello time. hello time value can be configured between 1 to 10 seconds.
* SHorter hello time determines faster detection of topology changes.
* Forward delay
* it is the amound of time that a port stays in a listening and learning state during STP convergence.
* Default vlaue is 15 seconds
* spanning-tree vlan <vlanID> forward-time <time>
value can be configured between 4 to 30 seconds.
* Spanning tree path cost
* The interface path cost is an essential component for root path calculations.
* Root path is found based on cumulative interface STP cost to reach the root bridge.
* STP path cost is numerical value assigned to a switch interface based on its bandwidth.
* lower cumulative path cost is prefferable
* Each link adds its interface cost along the path
* Root path cost is the sum of all interfaces costs along the route to the root bridge.
Short mode
* this mode uses 16-bit cost values
* uses refference bandwidth 20Gbps
* cost values become insufficient or small for very high speed interfaces
10Mbps 100 2,000,000
100Mbps 19 200,000
1Gbps 4 20,000
10Gbps 2 2000
20Gbps 1 1000
100Gbps 1 200
1Tbps 1 20
10Tbps 1 2
* as interface speeds exceed 10Gbps the available cost values become too limited
Long Mode
* To accomodate high speed interfaces (10Gbps, 40Gbps, 100Gbps etc) STP added a 32-bit long-mode
path cost system.
* uses reference bandwidth of 20 Tbps
* supports very high-speed links with granular and scalable cost values
* supports speed beyond 10Gbps
* allows STP to make better forwarding decisions in high-speed environments
* Spanning-tree path cost method long
command is used to configure a switch to use long mode path cost
* all switches in a L2 domain must use same path cost method
* If path cost mode mismatches may cause
incorrect STP decisions
inconsistent root path cost values
potential loops or sub-optimal forwarding
* before enabling long mode
Audit the entire environment
ensure every switch model and OS version supports long mode
Plan Maintanance window if needed
* when STP cost calculation differs across switches, STP topology becomes unstable as follows
same physical path may appear
low cost to some switches ( using short mode )
High cost to others ( using long mode )
* this leads to incorrect STP elections and poor convergence.
* uniform configuration across the entire L2 domain is mandatory.

Building STP topology

* Switches does not have any customization for STP. All the devices contains default STP settings.
* Root bridge election
* First step is to identify the root bridge.
* Every switch initially assumes it as a root bridge during boot.
* Switch sets its local bridge ID as a root bridge ID in all outgoing BPDU advertises to all other switches
in the topology.
* switch listen to the neighbors BPDU and compares the advertised root bridge ID with its own bridge ID.
if neighbors BPDU is inferior switch ignores neighbors BPDU, advrtise its own BPDU as claiming itself
as the root bridge.
if neighbor BPDU is superior switch accepts the superior BPDU
Switch updates its own BPDU with
the new root bridge ID
updated root path cost = incoming BPDUs root path cost + interface cost.
Switch forwards updated BPDU information across topology.
* STP prefers the switch with the lowest bridge ID as root bridge
* Bridge ID has two components
Bridge priority - switch with the lower priority is preffered
System MAC address - if priority is same, switch with the lowest MAC address is preffered
* Priority values can be changed manually to control STP behaviour. this ensures optimizing placement of
root bridge prevent the
making older switch from becoming the root bridge.
* show spanning-tree root - To display root bridge. Output includes
VLAN number
Root bridge identifier
root path cost
hello time
Max age time
forwarding delay
* On the root bridge, root path cost is always 0. ALl BPDUs originating from the root bridge advertise
RPC = 0
* RPC inside the BPDU represents only the cost from that switch to root bridge.
* Switch does not include the cost of the outgoing interface used to transmit the BPDU. It simply
advertises the root cost it has
already calculated.
* Recieving switch adds its own interface cost on which BPDU has recieved.
* New root path cost = BPDUs root path cost + recieving interface cost
* Root port selection
* Once root bridge is identified, all non-root bridges must determine root ports.
* Root port is the switchs best path back to the root bridge.
* Root bridge keeps sending BPDU messages out of all its ports, switches compares recieving BPDU to
decide which port leads most
efficiently towards the root.
* Switch selects the port associated with the most preffered BPDU using below five steps
Interface associated to lowest path cost is preffered - most important criteria
this is primary and most significant factor. lower cumulative cost = more prefered port.
interface associated to lowest system priority of the advertising switch is preffered
interface associated to lowest system MAC address of the advertising switch is preffered
if Multiple links exist to the same switch, lowest port priority from the advertising switch is prefered
default port priority is 128
if multiple switch exist to the same switch, lowest port number from the advertising switch is preferred.
* Blocked Designated switchports
* After the selection of root bridge and root port, all other ports on all switches are initially considered as
designated ports.
* If two non-root switches are connected each other with active designated ports creates a potential loop.
so one side of the link
must enter into blocking state to prevent forwarding loop.
* if two non-root switches connected each other with the redundant links, switch examines the BPDU
recieved from the neighboring DP
and applies below strategy
* The port must not be an root port. if a port is a root port it is never blocked
* the switch with the lower root path cost to the root bridge becomes the forwarding designated port.
switch with the higher root path cost
places its port into blocking state.
* switches compares system bridge priority, the switch with the lower bridge priority stays in forwarding.
Neighbors DP blocks.
* switches compares system bridge MAC, the switch with the lower bridge MAC stays in forwarding.
Neighbors DP blocks.
* Switches compare port priority in BPDU. Lower port priority stays in forwarding. Neighbors DP
blocks.
* the port with the lower port number stays in active. neighbor DP blocks.
* show spanning-tree vlan <vlan-id>
command is used to verify the information about ports stp state.
output displays
root bridge information
loca bridge infomation
interfaces STP port cost
Port priority
port type
STP state (forwarding/blocking)
Role (Root,Designated,alternate/Blocking)
* Port types are
P2P - point to point - connectes to another network device
P2P edge - Port with port fast is enabled.
*TYPE_Inc-, this indicates port configuration mismatch between switches
port type incorrect or port mode misconfigured (access vs trunk)
* root bridge section in the non root bridge output shows
total root path cost from local switch to reach root bridge
local switchport choosen as RP
* this confirm which path the switch is using to reach the root bridge and also whether STP calculations
are consistent across the topology.
* All the ports on the switch with the lower bridge ID will be forwarding state.
* one of the ports with higher bridge will be marked as alternate/blocked port.
Alternate port is backup path to the root bridge
transit to the forwarding state if the primary path fails
* Show spanning-tree
command is used to verify the STP state for every VLAN on every interface.
is also used to validate and troubleshoot STP behaviour in environments with trunk links
as trunk ports carry multiple VLANs
global command output includes STP state for every VLAN on an interface for every interface
this becomes more long and cluttered
Every interface appear multiple times - once for each VLAN
it is difficult to focus on a specific interface or VLAN
* Show spanning-tree interface <interface-ID>
this command reduces the size of the output by focusing on single interface.
displays
STP state for all VLANs for the single interface
Allows quick verification of Forwarding/Blocking behaviour
cleaner than viewing entire STP table.
* Detail keyword highly useful information for troubleshooting such as
path cost
port priority
interface link type
Number of STP state transitions
BPDU statistics (Sent/Recieved count)
STP role and state for each VLAN
* If VLAN is not in the allowed list on trunk port it wont appear in
STP tables
MAC address tables
Forwarding decisions
* STP Topology changes
* Configuration BPDU consistently flow from the root bridge towards all downstream switches to
maintain spanning tree structure
* STP must re-calculate the topology to ensure loop free operation if the network change happens as
A switch failure
A link failure
A previously inactive link becoming active.
* STP recalculation begins with a TCN (Topology change notification).
* Non-root switch that detects a link status change sends TCN BPDU towards the root bridge, through its
RP.
* Upstream switch sends topology change acknowledgement towards sender and forwards TCN out its
RP. process continues untill it reaches root bridge.
* Once the root bridge recieved TCN, it creates the new configuration BPDU with the topology change
flag set, then it is flooded to
all the switches.
* when non-root bridge recieves configuration BPDU with the topology change flag set, all switches
change their MAC address timer (300 sec)
equal to the forwarding delay timer(15 seconds).
* switches flush out MAC addresses for devices that are not communicated with in the 15 seconds.
* this prevents switches from sending traffic towards ports or paths that are not valid due to
port failures
link movements
switch failures
VLAN topology shifts
* Flusing the MAC address table tempararily increases unknown unicast flooding while it is rebuilt.
* MAC timer is reset to original when it recieves Configuration BPDU with no TC flag set.
* TCNs are generated per VLAN basis, not per switch basis.
* Topology change impacts only that specific VLANs MAC table.
* VLANs with large number of hosts experience more impact.
* As number of host increases, more likely TCN generation is to occur and more hosts that are impacted
by the broadcasts, more frequent
MAC flushes during changes.
* VLAN design directly affects STP instability.
* Show spanning-tree vlan <vlan-id>
command is used to verify the topology changes on a switch. topology changes needs to be verified as
part of the troubleshooting process.
command displays
topology change count
time since last change occured
* Sudden or continuous increase in TCNs indicates a potential problem and should be investigated for
Flapping link
faulty cable or port
misbehaving connected device
switch constantly rebooting
devices repeately pugging unplugging
missing portfast configuration on access ports.
* Frequent TCNs often indicates a problem typically a - flapping port, misconnection, unstable link.
* Troubleshooting as follows
identify which port is triggering topology changes using below command
show spanning-tree vlan <vlan-id> detail
look for
number of topology changes
last topology change occured
on which port it was occured
Determine what the port is connected
A host (PC, server, AP, IP phone)
Another switch
host ports commonly generate TCNs if they are not set as edge ports (port fast)
switch-to-switch links generating TCNs usually mean there is instability upstream.
use the below commands to find upstream device
show cdp neighbors
show lldp neighbors
use network documentation
If the port connected to another switch run the same command and check the details
Repeat untill you reach the last switch showing the change
switch reporting TCN and the port connected to host, OR
switch where the upstream device no longer shows further TCN propagation
The final switch is usally the location of
Flapping host NIC
misconfigured portfast port
an unstable link
A rougue device (HUB, Looped cable etc)
Fix the issue on identified port
enable portfast, replace cable, stabilize link etc
Converging on direct link failure scenarios
* when a switch looses power, reboots or cable is unplugged, interface physical state goes to down state
which immediately notifies
upper layer switching process, including STP.
* STP treats this as a direct link failure. in this case network reacts in three different ways.
Scenario1 :
* The link failure between two non-root bridges where one of the port between them is in blocking state
* The failure doesnot disrupt forwarding as the port is already in blocked state and it is not forwarding
any traffic.
* traffic continues to flow normally towards root bridge.
* Both non-root briges forwards TCN towards the root bridge, the switch triggers MAC address flush
across the L2 domain to maintain accurate forwarding.
Scenario2 :
* In this scenario, the link between root bridge and non-root bridge failed, and also the other interface on
that non-root bridge is in blocking state.
* this failure is more disruptive, Switch becomes isolated from root bridge untill STP reconverges and
traffic from alternate path is
tempararily blocks as the port is in logically blocking state.
* Switch detects link failure on its RP. it must choose an another RP towards alternate path.
* Blocked port must transition through Listening, Learning, Forwarding.
* generally switch at the other side of the link needs to generate TCN, But in this case it is a root bridge.
Root bridge doesnot generate TCN.
* Switch removes BPDU recieved from its interface from root bridge as it is down.
* Switch needs to send TCN to notify the topology change to the root bridge but the interfaces in down
state.
* Root bridge advertises configuration BPDU with topology change flag out of all its connected ports.
* Other switches recieves configuration BPDU and adds its interface cost and forwards to the other
downstream switches in the topology.
These packets impact on all switches exist in the same L2 domain.
* so that downstream switched continue to learn correct STP information.
* switches recieves configurstion BPDU with the topology change flag set. switches reduces MAC
address age timer to the forward delay timer
to flush out older MAC entries.
* switch 2 doesnot know what changed in the topology because
Sw2 is not physically involved in the failure. it keeps recieving same BPDU as before.
SW2 RP is still recieving valid BPDU messages from root bridge
SW3 alternate port is in blocking state and not relaying updated BPDU
SW2 has no immediate BPDU changes to react to
SW3 must detect and process the failure before informaing upstream switches
* SW3 does not require to wait for MAX age timer (20 seconds) with a link failure. MAC age timer
applies when link stays up but BPDUs stop.
* SW3 restarts STP on its blocked port listening, learning, forwarding.
* Total convergence time for SW3 is 30 seconds, During this time SW3 experience downtime.
Scenario3 :
* In this scenario, the link between root bridge and non-root bridge failed, and also the other interface on
that non-root bridge is in forwarding state.
* root bridge and non root bridge detects the physical link failure.
* switch would advertise TCN if it is a non-root bridge. root bridge does not advertise TCN.
* Switch removes BPDU recieved from its interface from root bridge as it is down.
* Switch needs to send TCN to notify the topology change to the root bridge but the interfaces in down
state.
* root bridge advertises a configuration BPDU with the topology change flag out of all ports. this BPDU
is relayed to SW3. SW3 cannot
relay this to SW2 as the port is still in blocking state.
* SW2 assumes it as a root bridge and now it is advertises configuration BPDU with itself as the root
bridge.
* SW3 recieves the configuration BPDU with topology change flag from SW1, SW3 reduces MAC
address age timer to the forwarding delay timer
to flush out older MAC addresses. SW3 discards SW2 configuration BPDU as it is still recieving superior
from SW1.
* MAC age timer expires on SW3, port which in blocking state transit to the forwarding in the way
listening, learning, forwarding.
* While SW3 was in listening state, it can forward next coming BPDU from SW1 to SW2.
* SW2 receives it recongnize it as superior and marks interface as the root port and transit it to the
listening state.
* The total convergence time for SW2 is 50 seconds.
20 seconds for the MAX age timer
15 seconds for listeing state
15 seconds for learning state
Indirect Failures
* Indirect failures happen when
the link stays physically up
STP BPDUs are impaired, filtered or corrupted.
switches cannot exchange correct STP information
* Timers are required to detect and remediate the topoloy.
* An event occurs that impairs or corrupt data on the link
Noise, Data corruption, misconfigured ACL, Duplex mismatch, BPDU filtering, L1 interference.
But the interface stays in up state.
* SW3 stops recieving configuration BPDU on its RP. Keeps cached entry on its RP. SW1 configuration
BPDU via SW2 is discarded as SW3
interface is in blocking state.
* SW3 Flushes cached entry on its RP after MAX age timer expires. then SW3 interface transit from
blocking state to listening state.
* Now SW3 accepts SW1 configuration BPDU via SW2 and now the port is marcked as RP and transit to
forwarding state through listeingand learning.
* Total time for reconvergence on SW3 is 50 seconds.
Rapid Spanning tree protocol
* STP 802.1D was designed to prevent loops by building one single spanning-tree topology for the entire
network.
* 802.1D have slow convergence
* introduced scalability issues in environments with many VLANs
* Did not support efficient traffic engineering and load balancing
To overcome 802.1D limitations and improve scalability and flexibility cisco created
PVST - Per VLAN spanning-tree
It is a cisco proprietary
Builds a seperate STP instance per VLAN
Allowed traffic engineering by manipulating STP root per VLAN
PVST+ -
improved version of PVST
supports interoperability with 802.1D
still cisco proprietary

each VLAN can have its own root bridge

Better load sharing across redundant links
RSTP was developed to integrate concepts of these protocols with other enhancements such as
Much faster convergence (1-2 seconds)
Immediate role negotiation with out relying on timers
better handling of link failures
new port roles and states
better scalability
backward compatibility with classis 802.1D
RSTP reduces complexity
IEEE standared - not proprietary
RSTP 802.1W port states
* RSTP has three port states
* Discarding - switchport is enabled but does not forward any user traffic. this ensures that loop is not
created while converging network.
RSTP combines three old STP states are
disabled, blocking, listening
The port recieves BPDU and process BPDU.
it is a initial state when a device is powered on. During the proposal/agrrement handshake when
determining topology.
Blocking redundant or backup links (alternate or backup ports)
* Learning - The port begins learning MAC addresses from incoming frames. Switch sends and recieves
BPDUs but still doesnot forward any other
network traffic besides BPDU.
Switch build MAC address table before begins forwarding network traffic.
this ensures preventing topology from unknown unicast flooding when the port is transition to
[Link] ip convergence
* Forwarding - The port is full active in the network. the switchport forwards all network traffic and
updates the MAC address table as expected.
switchport sends and recieves BPDUs. this is the final,fully operational state for ports participating in the
STP.
RSTP Port roles
* Root Port - A switchport that connects to the root switch or upstream switch in the STP topology. RP is
the best path from the
switch towards the root bridge There should be only one RP per VLAN on a [Link] always should be
forwarding state.
it is choosen based on lowest root path cost.
* Designated Port - A switch port that recieves and forwards network traffic to other switches. DP provide
connectivity to downstream
devices and switches. there shuld be only one active DP per [Link] with lowest root path cost on the
segment.
* Alternate Port - A network port that provides alternate connectivity toward the root switch through a
different switch.
it listens to the BPDU from other upstream switch. it stays in discarding state. instantly transitions to the
RP if the current RP fails.
choosen when multiple paths exist to the root.
Backup port - A network port that provides link redundancy towards shared segment within the same
collision domain, which is typically a HUB.
Backup port stays in discarding state.
RSTP port types
* RSTP classifies ports into three types. Port types describes the nature of the connection.
* Edge port - A port that is directly connected to an end device (PC, Printer,Server,IP phone, AP)
equal to portfast in STP. this cannot create the loop as it has only one [Link] goes to
forwarding no RSTP handshake.
ideal for user access ports. if an edge port recieves a BPDU, it immediately loses its edge status and
becomes a non-edge port.
ensures rapid connectivity for host devices, avoids unneccesary STP delays.
* Non-Edge port - A port that recieved atleast one BPDU. Means port is connected to another switch or
STP capable device.
this port can not bypass STP logic. must participate fully in STP. it can be a RP, DP, AP, BP.
* Point to Point - A port that connects switch-to-switch using full duplex links. This port participates in
RSTP proposal/agrrement
handshake. enabling rapid convergence. used for interswitch trunk or access links. enables fast topology
change handling between switches.
* Shared Port - A port connected via half-duplex link or through old shared medium (Hub). works more
like traditional STP ports (Slow convergence)
does not use fast RSTP negotiation. typically bcomes Designated or back up depending on BPDU
exchange. RSTP does not if the port is connected to
switch or hub or multiple switching paths, this makes the topology uncertain. BPDUs might collide.
RSTP proposal/agrrement process requires point-to-point, each can send and recieve BPDU
independently. no collisions.
Building STP topology.
* RSTP dramatically speeds up convergence by using handshakes, point-to-point detection, and
synchronization to prevent loops when
switches [Link] RSTP, switches exchange handshakes with other switches to transition through the
STP states faster. switches
go through a synchronization process when they connected first time, to safely join the network without
creating forward loops.
switches establish a bidirectional handshake across the link to identify the root bridge.
As the first two switches connect each other, RSTP checks if the link is full-duplex (point-to-point
connection).
point-to-point links allow the proposal/agrrement hadnshake.
proposal/agrrement mechanism is used to rapidly transition ports into forwading state. it Replaces slow
STP timers.
Switches establish a handshake with each other to advertise a proposal that their interface should be the
DP for their segment.
DP is the port responsible for forwarding traffic on a segment. There can be only one DP per segment.
Switch with the lowest bridge ID have DP [Link] inferior switch marks its local port towards the root
switch as [Link] also
move all other non-edge ports into discarding [Link] ensures that the switch doesnot forward any traffic
that might cause loops during
[Link] switch sends an agreement to the root that tell synchronization is occuring on it. this
is the critical step that enables
rapid transition on both ends.
switches move their ports to forwarding state. this replaces the STP timers (Listening and learning). the
link is fully operational and loop-free
The same process repeats for any switches connected downstream. Each inferior switch must first
synchronize its own topology and proceed outward.
this ensures network is loop-free and converged rapidly.

RSTP is designed to converge must faster than 802.1D. this is accomplished through improved STP
timers, rapid hadnshake, and a synchronization
mechanism. RSTP waits for only three missed hello BPDUs before aging out a port (6 seconds).
synchronization process ensures that switches do not create any loops and do not wait for timers. moves
ports into forwarding as soon as it
guaranteed safe.
if a downstream switch fails to acknowledge a proposal BPDU then,
RSTP assumes neighbor is slow or non RSTP. it reverts to STP 802.1D behaviour. RSTP must never
enable forwarding on a port unless the
neighbor confirms it is synchronized and safe.

=========== Advanced STP Tuning ==========

STP topology tuning - cpntrol and optimize STP topology by influencing root bridge selection and port
roles. Modifying root bridge selection
or moving blocking ports to designated ports.
* root bridge is the logical centre of an STP topology.
* choosing the correct root bridge ensures optimized traffic flow.
* lowering bridge priority on the switch can tune the topology.
* secondary switch can be configured as a Backup by setting its priority slightly higher than root bridge. it
ensures predictable failover behaviour.
* STP determines which port forward and which port block to prevent loops. port roles can influence by
adjusting port cost and priority.
* this helps moving blocking ports to more desirable places for optimal redundancy and performance.
Additional STP protection mechanism - protects against misconfigurations, rogue devices, unexpected
STP behaviour.
Root guard -
* prevents DP from becoming [Link] on ports where you never want to recieve superior BPDU. protects
stability of choosen root bridge.
BPDU guard
* Shuts down a port when BPDU is recieved. Ideal for edge/access ports connected to end devices.
prevents accidental loops causing by
unmanaged or rouge switches.
Loop guard -
* prevents ports from transitioning to forwarding state due to UDLD or missing BPDUs. ensures stability
in STP for redundant topology.

STP Topology Tuning

* Purpose of STUP tuning is to placing the root bridge on a specific switch (distribution or core layer) and
also forwarding and blocking ports
are strategically controlled to stable and predicatble traffic path.
* This ensures optimized traffic flow, faster convergence, lower chance of loops or unexpected STP
behaviour, Better resillency.
* strategically selecting the root bridge
lowest bridge priority
center of the STP topology
ensures all path calculations flow towards intended point
prevents random or unplanned switch to become root bridge
* Controlling port roles
adjusting port cost and port priority to change which port forwards and which port blocks.
ALternate ports are positioned intentionally not randomly.
* Design considerations
Hardware platform - processing capabilities, link speeds, feature supported.
Resillency - redundancy exist, loops do not form, redundancy and failover happens cleanly.
Network topology - Root bridge placement, port cost assignments, back path planning.
Placing the root bridge
* Ideally the root bridge is placed on core switch. secondary root bridge should be choosen to take over if
primary fails.
* this ensures minimizing unexpected STP recalculations and ensures consistent forwarding paths.
* Root bridge placement is accomplished by lowering bridge priority the the lowest value possible.
secondary root bridge priority
will be slighly higher than root bridge.
* ALl other switches should have higher priorities so they can never become root bridge unintentionally.
* this ensures consistent placement of the root bridge.
* Priority can be set eaither of the below commands
spanning-tree vlan <vlan-id> priority <priority>
priority is the value between 0 to 61440 in increments of 4096
spanning-tree vlan <vlan> root {primary|secondary} [diameter <value>]
this command execute the script and assign priority numerically along with the potential for timers if
diameter keyword is used
sript assigns priority values as primary - 24576 secondary 28672.
Diameter keyword adjusts Hello time, MAX-age, [Link] tune the STP convergence and modfies
the timers.
Diameter value tell the STP how large the L2 network is based on switch hops exist between last switch
and the root bridge.
these values impact how quickly STP converges after topology change
diameter value ensures
reliable convergence
stable STP behaviour
No excessive BPDU delays in large topologies.
* STP timers do not need to configure on every switch. root bridge sends BPDU to all switches. these
BPDUs contains timer values.
* other switches adopt timers from the root bridge.
* Placiing the roo bridge is one of the most important STP design decisions becuase it directly affects
traffic flow
STP convergence time
Number of hops to the farthest switch
which links will forward or blocks
overall network stability
* well placed root bridge ensures predictable L2 paths and minimizes unnecessary STP recalculations
* Design considerations for Root placement
* Minimize the network diameter
root bridge should be placed in good central position. so every switch reaches it in fewer L2 hops.
convergence is faster, network stability is higher, link failure effects fewer [Link] long stap path
calculations.
* Analyze redundant links.
the goal is to make traffic flow efficient and [Link] where redundant path exists. undestand
which link will likely block and design accordingly.
* Root bridge performance capacity.
root bridge must be capable of handling
High traffic volume, High CPU load, BPDU generation for the entire domain. strongest switch should be
the root bridge in the topology.
* Root bridge usually placed at distribution or core layer, where L2 meets L3. this keeps spanning-tree
domain centralized and stable.
* To prevent accedental take over of root bridge role on misconfigured or rogue devices
* set explicit priority values - primary = 0, secondary = 4096. this ensure no other switch becomes root
even with lower MAC.
* Use root guard for protection - root guard prevents another switch from sending superior BPDU and
incorrectly taking over the root role.
* root guard should be enabled on
ports where the root bridge should never appear.
typically access-distribution uplinks
* If a superior BPDU recieved port is placed into root-inconsistent state. it returns to the normal when bad
BPDU stops.
Modifying STP root port and blocked port
* Each switch port participating in STP has a cost based on its link speed. this cost is used to calculate
root path cost which define
* Best path towards root bridge
* port roles such as Root port, Designated port, alternate ports (blocked ports)
* switch does not include its own outgoing cost when it sends BPDU. it only includes cost upto that
switch.
* The recieving switch includes its local port cost to the vlaue in the BPDU.
* The cost continue to grow as the BPDU travels through the topology.
* STP uses lowest root path cost to select the root port on each switch.
* spanning-tree vlan <vlanid> cost <value> - command is used to manually change the cost
vlaue
* By changing the STP cost vlaue, can change the forwarding path.
* lower the cost on port - makes the path more preffered - can change alternate port to forwarding.
* Higher the cost on port - makes the path less preffered - can change forwarding path to alternate
* without VLAN keyword cost change applied to all vlan. with VLAN keyword cost change applies to
only to that VLAN.
* STP chooses the path with the lowest root path cost
* Port cost directly effects
* which port becomes
* root port
* designated port
* alternate (blocking)
* adjusting port cost is reliable way to tune the STP topology.
STP Port priority
* Every switch participating in STP has two components in its port ID
* Port priority = default = 128, in steps of 16
* Port number = based on hardware port index
* Port ID = Port priority + Port number
* Port priority impacts when multiple links are used between switches.
* If upstream switch sends BPDU with
same root bridge ID
same root path cost
same system ID
then the remaining tie brakers are port priority and port number.
* changing the port priority allows to control the sepcific port becomes root port or alternate port.
* Port priority and port number or controlled by the upstream switch because upstream switch is closer to
the root bridge.
* Port priority can be modify with
spanning-tree vlan <vlan-id> port-priority <value>
vlan keyword is used to change the priority on a Vlan by Vlan basis.
Additional STP protection Mechanism
* L2 networks does not contains TTL mechanism in ethernet frames.
If a forwarding loop occur, frames can circulate forever
Switches become overloaded and eventually crash
broadcast and multicast traffic flooded out all ports.
* forwarding loops occur when the topology allows multiple active paths between two switches.
* common symptoms of a forwarding loops
High CPU utilization
low available memory
Massive bandwidth consumption
MAC address table constantly changing.
CPU spikes, network-wide slow down of all applications
Network thoroughput impacts drastically.
switch crashes due to resource exhaustion.
* if switch recieves frames on multiple interfaces
* switch thinks host is moved, updates MAC address table repeatedly, constantly relearning burn CPU
cycles.
* Causes for Forwarding loops
* STP diabled on a switch - switch creates unprotected loops, cuasing immediate instability.
* Misconfigured Load balancer that transmits traffic out multiple ports with the same MAC address.
* Misconfigured Vswitch that bridges two physical NICs - introduces unmanaged L2 loop
* End users plugging in small switches or hubs(unmanaged, dumb)
* Catalyst switches detect a MAC address flapping between interfaces and notify via syslog with
MAC address of host, VLAN, Ports between which the MAC is flapping.
* this message must be investigated immediately and fix the issue and ensure no forwading loops exist.
* to avoid this, we should check STP for all switches hosting the vlan mentioned in syslog message to
ensure that spanning tree is enabled
and working properly or not.

Root Guard
* STP feature that is enabled on port-by-port basis
* this feature prevents any downstream switch from becoming root bridge. ensures only choosen root
bridge stays in control of STP topology.
* Root guard prevents the port from becoming a root port.
* Root guard is applied on designated ports facing the towards other/downstream switches that should
never become root bridge.
* Root guard is needed because
downstream switch may be misconfigured
connected by mistakely
send superior BPDU
attempt to take over as a root
this can break the entire network design
root guard stops this by blocking port that recieves a superior BPDU.
* Root guard places port into root-inconsistent state if it recieves superior BPDU.
* in this state port behaves like an STP listening [Link] does not forward [Link] port will not move to
forwarding untill BPDU stops.
* the port automatically recovers, and returns to normal designated forwarding state, when the superior
BPDU stops.
* spanning-tree guard root - command is used to enable the root guard on an interface.
* Do not use root guard on
* trunk uplinks towards root
* ports that could legitimately become root ports.
STP Portfast
* A TCN generated whenever port goes up and down. TCN generation for access ports connected to the
hosts does not make sense as it has
only one connection to the [Link] ports does not effect the L2 topology.
* STP portfast feature disables TCN generation on access ports. it ensures network stability and reduces
STP recalculations.
* STP portfast feature bypass the listening and learning states and forwards traffic immidiately.
* STP portfast is useful for the environments where the computers use DHCP and PXE boot and for the
devices that expects quick network access.
* if a port-fast enabled port recieves BPDU
portfast is automatically disabled
port returns to normal STP behavior. port progresses through listening and learning state.
protection against accidental switch-switch connections.
* spanning-tree portfast - enables port fast for access port
* spanning-tree portfast default - enable portfast globally for all access ports
* spanning-tree portfast disable - portfast needs to be disable on a specific ports if it is enabled globally.
this command removes portfast
* spanning-tree portfast trunk - used to enable portfast on trunk links.
this command should be used on ports connected to single host
such as server with only one NIC that is running a hypervisor with VMs on a different vlan
A host with subinterfaces
portfast are displayed with P2P edge
BPDU guard
* BPDU guard is a safety STP feature used on access ports especially on the ports enabled with portfast
feature.
* If the portfast port recieves BPDU then the BPDU guard places port into errdisable state.
* This ensures port does not forward any network traffic to ensure no forwarding loops occur
* This ensure loops can not be created accidentally even if an unauthorized switch connected to topology
on the access ports enabled with portfast.
* spanning-tree portfast bpduguard default - enable bpduguard globally for all portfast enabled interfaces.
* spanning-tree bpduguard [enable|disable] - enable or disable BPDU guard on specific interface.
* show spanning-tree interface <interfaceID> detail
this command displays
portfast status
BPDU guard status
port status - errdisabled or not
* By default, ports that are put in the errdisabled state because of BPDU guard donot automatically
restore themselves
* error recovery services can be used to reactivate ports, thereby reducing administrative overhead.
* errdisable recovery cause bpduguard - commands is used to recover the ports that were shutdown from
BPDU guard.
* errdisable recovery interval <time-seconds> - command is used to configure time interval to check the
error recovery for ports
* error recovery service operates every 300 seconds(5 Minutes). this can be changed to a value of 30 to
86400 seconds.
BPDU Filter
* BPDU filter is a STP feature that prevents the sending of BPDUs on a switch port.
* it is used only in controlled environments because incorrect use can easily create L2 loops.
* spanning-tree portfast bpdufilter default - command is used to configure bpdu filter globally on all
portfast interfaces.
* spanning-tree bpdufilter enable - this command is used to enable BPDU filter to specific interface. it
applies to interface even if
portfast is not enabled
* The behaviour of the BPDU filter depends on whether it is configured as global or interface-specific for
portfast ports.
* if BPDU filter is enabled globally,
* It applies on interfaces with portfast enabled.
* when a port comes up, it sends 10-12 BPDUs to check if another switch exists.
* if switch doesnot recieves BPDU, BPDU filter activates
* If switch recieves BPDUs BPDU filter immediately disables and the port runs notmal STP.
* preffered switch doesnot process BPDU recieved but it still transmits BPDU to downstream switches.
* non-preferred switch process the BPDUs recieved from the preffered switch but it doesnot transmits
BPDUs to preffered switch.
* If BPDU filter enabled on interface
* port never sends BPDUs
* Port never reacts to recieved BPDUs
* do not participate in STP at all. Port behaves as STP is disabled
* portfast permanently always enables
* port is always in forwarding state.
* Port behaves as access port connected to PC, even if switch is connected.
* this is root cause of loops
broadcast floods both directions
unknown unicast traffic floods
multicast traffic floods
MAC tables flapping
traffic loops endlessly
causes L2 loops independent of BPDU exchange.
Unidirectional links
* Fiber optic connections use two stands
one stand for transmit Tx - sends the date
another stand for recieve data RX - recieves data.
transmit on one side connects to the recieve on another side.
* Normally, regualar data flow, STP BPDUs to be exchanged, Healthy link state detection allows on both
directions.
* An unidirectional link occurs when one stand is broaken but the other still works.
* some older fiber optic transceivers only check for recieved light to decide whether the link is up or
down.
* due to this reason the interface may still show line protocol is up and link is up, however BPDUs are not
able to transmitted in one directions
leading to incorrect topology assumptions.
* downstream switch assumes its root port lost the root bridge.
* it starts a root election and may choose a different interface as its new root port.
* Now traffic recieved on new root port and forwarded out the stand that is still working.
* this mismatched topology leads to L2 forwarding loop.
* STP loop guard and UDLD are the solutions to resolve these kind of scenarios.
STP loop guard
* STP loop guard prevents an STP loop that can occur when a switch stops recieving BPDUs on a root or
alternate port. causing that
port to mistakenly become as a designated port.
* loop guard protects root ports or alternate ports from moving to forwarding state.
* If BPDU stop arriving, the port goes into a loop inconsistent state rather than forwarding. this blocks the
port to prevent the loops.
* Port automatically restores and resumes normal STP transitions (blocking, listening, learning,
forwarding).
* Loop-guard is protective and self healing.
* spanning-tree loopguard default - loopguard is enabled globally using this command. applies to all non-
designated ports.
* spanning-tree guard loop - loopguard is enabled on an interface basis.
* this feature is most useful on shared fiber or metro ethernet environments.
* Loopguard must not be used on portfast enabled ports. it is meant for root/alternate ports that
participates in STP.
* If we enable loopguard on portfast ports
* portfast ports are edge ports connectes to PC, servers etc...
* these ports does not recieve any BPDUs, so this feature puts port into loop-inconsistent state.
* this unnecessarily blocks edge port.
* show spanning-tree inconsistentports - used to view inconsistent ports.
Unidirection link detection
* UDLD allows for the bidirectional monitoring of fiber-optic cables.
* UDLD is a L2 protocol that detects unidirection link failures expecially on fiber optic connections.
* this condition can cause STP loops, blackholing, inconsistent forwarding.
* UDLD prevents this by constantly exchanging special UDLD packets between two switches.
* UDLD continuously verifies bidirectional connectivity at L2.
* UDLD operates by transmitting UDLD packets to neighbor. UDLD packets includes,
system ID
Port ID of the interface transmitting the UDLD.
a sequence number.
* If any switch stops seeing its own information echoed back, then switch assumes that the link is no
longer truly bidirectional.
in this case switch takes action depending on mode.
* common causes for unidirectional link
one broken fiber stand
Dirty or mislined optical connectors
Faulty SFP modules
incorrect cabling, polarity mismatch.
* UDLD catches this before STP or routing can create a loop or outage.
* UDLD operates in two modes.
* Normal mode
* if frame is not acknowledged, the link is considered undetermined and the port remains active. no
shutdown occurs.
* this mode provides detection but no automatic protection.
* Aggressive mode
* When UDLD packet is not acknowledged
* switch sends 8 fast retries, 1 per second.
* if none are acknowledged
* port is placed into error-disabled state.
* this prevents loops and forwarding inconsistencies.
* aggressive mode provides fast, deterministic protection.
* udld enable [aggressive] - this command is used to enable UDLD globally.
* this command enables UDLD on any small form-factor pluggable [SFP] based port.
* udld port disable - this command is used to disable on a specific port with this interface configuration
command.
* udld recovery [interval <time>] - this command is used to enable UDLD recovery.
interval keyword allows to modify the timer from the default value of 5 minutes.
* udld port [aggressive] - this command is used to enable udld on a port-by-port basis
aggressive keyword places the port into UDLD aggressive mode.
* udld must be enabled on both ends. it works by exchanging hello packets in both directions.
* If UDLD is enabled on only one side, the protocol cannot complete echo process. so the link appears
unidirectional to the UDLD enabled switch.
* If only one end is configured UDLD
UDLD neighbors will not form
aggressive mode place port into errdisable state thinking the link is unidirectional
* it relies on a bidirectional exchange as follows
send its system ID + Port ID
receive the partner echo back
verify continuous bidirectional communication.
* show udld neighbors - this command is used to verify the UDLD neighborship. shows summary of udld
nighborship. displays
local interface
Device ID [remote system ID]
Port ID [remote interface]
current UDLD state [bidirectional, undetermined, etc]
useful for quick health check up
* show udld <interface-id> - this command is used to verify the detailed UDLD information per interface
such as
UDLD state [bidirectional, echoing, disabled, err-disable]
local system ID [serial number]
Remote system ID [remote switch serial number]
local interface ID
Return interface ID [the interface from which the echo is recieved]
number of UDLD messages sent or recieved
Aggressive mode status
* useful for deep troubleshooting

MSTP - MULTIPLE SPANNING-TREE PROTOCOL

* MST is the one of the three STP modes supported in catalyst switches.
CST - common spanning-tree
* supports only one STP instance for entire switch network.
* ALl VLANs share the same spanning-tree topology
* one root bridge for the whole network
* All vlans forward/block on the same links
* No vlan based load sharing is possible. (blocking specific VLANs on one link and other VLANs on
different links)
PVST/PVST+ - Per vlan spanning-tree
* it is a cisco proprietary protocol
* Each VLAN has its own independent STP instance/Topology.
* Each VLAN can have
* Different root bridge
* Different port costs
* Different Blocked/Forwarding links.
* Vlan-based load sharing - Link can be blocked for one VLAN forwarding for another.
* Vlans can be use different paths.
* high CPU & Memory cost due to one STP instance per VLAN.
* Slower convergence with many VLAN
* Not scalable for larger networks.
* when major trunk link fails, switch must process BPDUs for every VLAN and switch must process
multiple STP operations to converge the network.
MSTP -
* Mapping one or multiple vlans into single STP tree is called as MSTI (Multiple spanning tree instance)
* Reduces the number of STP instances while still enabling VLAN-based load balancing.
* VLANs are mapped to MST instances (MSTIs)
* Only one STP topology per instance, not per VLAN.
* Administrator can choose how many VLANs go into each MSTi.
* Highly scalable
* Reduced CPU/Memory usage.
* VLAN-based load balancing still possible
* fast convergence -
* Requires region configuration to match across swiches.
MST Region
* A grouping of MST switches with the same high level configuration is known as an MST region.
* MST region is group of switches that shares Region name, Revision number, VLAN-to-instance
mapping.
* MST region appears as a single virtual switch to external switches(PVST/CST/RSTP).
* BPDU exchange is simplified - BPDUs are exchanged internally, region sends only one BPDU outside.
* External STP sees one root, not mutiple internal MSTis
* only one external STP calculation occurs for the entire [Link] - common internal spanning-tree.
* use CST for small network with minmal VLANs
* use PVST when, pure cisco environment, need maximum traffic engineering.
* use MST when, large enterprise network, more number of VLANs, need scalability with some load
balancing.
MST Instance
* MST instance is the seperate spanning tree topology within an STP region.
* VLANs are mapped to MSTIs so that multiple VLANs can share the same STP calculation.
* MSTI is STP tree for group of VLANs
* this special instance is called IST - internal spanning-tree, is always first instance, instance 0.
* IST is the special mandatory MST instance.
* IST runs on all switchports inside the MST region
* It exists even if no VLANs are associated to the ports.
* Acts as the foundation instance for all MST operation.
* MST doesnot send seperate BPDU for each instance.
* IST BPDUs carry additional information about other MSTIs and that is transmitted throughout the
region.
* Only IST BPDUs are actually transmitted through the [Link] of number of instances while
providing neccessary information
to calculate the STP for other MSTIs
* IST BPDU contains
MSTI configurations
Root IDs
Port roles
path costs
for each instance
* IST reduces
CPU load
BPDU traffic
convergence time.
* this keeps STP traffic light and efficient inside large networks.
* IST is like Main envelope that carries all other instance topologies inside it.
* Number of MST instances depends on the switch platform.
* cisco swithes usually allow at least 16 total instances.
IST 0
IST 1 to 15
MST configuration
* MST configuration involves 5 steps.
* These steps must be consistent on every switch inside the MST region, else switches will not join the
same region.
Step 1 :
* Define MST as the spanning-tree protocol using below command.
spanning-tree mode mst
this command changes switch from PVST/RPVST to MST mode, allowing VLAN-to-instance mapping.
Step 2 :
* Define the MST instance priority
administrator can choose the which switch can become the root bridge for each MST instance.
Manually set priorty
spanning-tree mst <instance-number> priority <priority>
the priority vlaue between 0 and 61440 in increments of 4096
user primary, secondary shortcuts
spanning-tree mst <instance-number> root {primary | secondary} [diameter <diameter>].
primary = 24576
secondary = 28672
Step 3 :
* Map VLAN to MST instances
* By default all VLANs belongs to IST
* enter MST configuration mode
spanning-tree mst configuration
* Map VLAN to an MST instance
instance <instance-number> vlan <vlan-id-range>
* this determines how many STP trees needs to be maintain.
Step 4 :
* Specify the MST version number
* The revision number must match on all MST region switches.
* configure version number in MST configuration mode
revision <version number>
Step 5 :
* Define the MST region name
* Region name identifies which switches belong to the same MST region.
* By default region name is an empty string
* Region name must macth on switches
* VLAN-to-instance mapping must match
* command
name <mst-region-name>
MST Verification
* show spanning-tree mst configuration
* this command provides quick verification of the MST configuration in the switch.
* this includes
region name
revision number
VLAN-to-MST instance mappings
instances created
* this command is used to verify if all switches in the MST region match.
* Vlan mapping is not dependent on whether a VLAN is configured on a switch or not.
* Vlan mapping is simply a design/state configuration, not an active vlan list.
* Any VLAN not explicitly mapped to an instance is automatically mapped to IST
* MST shows output data as per-instance not per VLAN like PVST/RPVST
* show spanning-tree
* this is the basic spanning-tree command
* It shows
* MST instance numbers, not VLANs (this is because STP per instance not per VLAN. VLANs are
mapped behind the scenes)
* Root bridge for each instance
* Port roles (Root/Designated/Alternate/Backup)
* Port states (forwarding,Blocking,Discarding)
* Timers,cost,priorities
* Priority value of the switch is the MST instance plus the switch priority.
* show spanning-tree mst <instance-number>
* It displays detailed MST view. this command shows the MST topology table.
* shows which VLAN belongs to which MST instance.
* Displays root bridge, cost, priority, port roles.
* provides clear mapping between MSTIs and VLANs
* perfect for troubleshooting VLAN-path issues.
* shows output for all instances with out instance number. shows specific instance output with number.
* helps to understand which vlan use which topology
* which ports forward for those VLANs
* Whether the root is local or remote.
these are crucial during debugging.
* spanning-tree mst interface <interface-id>
* most granular command, displays per interface MST details
* it shows
* Port state/role per instance
* path cost per instance
* BPDU settings
* BPDU guard
* BPDU filter
* Portfast
* Link type
* Whether the interface participates in specific MSTIs
* instance-specific timers (hello, forward-delay, max-age)
troubleshooting
* why traffic is blocked on a trunk
* which instance is effecting which VLAN
* whether a link is blocking only for a specific MST instance.
MST Tuning
* MST supports tuning of port cost and port priority
* These settings influence which links become the root port or designated port for each MST instance.
* spanning-tree mst <instance number> cost <cost>
interface specific command used to set the interface cost.
* this setting is used to
* To force traffic for an MST instance to use a specific link
* To load balancing between MST instances
* To prevent port from being selected as root port
* spanning-tree mst <instance-number> port-priority <priority>
interface specific command sets the interface priority
* port priority effects tie breaking when two ports have same cost
* priority must be increments of 16, range 0-240
* lower number is higher priority
Common MST misconfigurations
* Network engineers frequently misconfigure MST in two areas
Incorrect VLAN assignments to IST
Improper pruning of VLANs on trunk links
* each of these can break MST operations
VLAN assignment to the IST
* IST runs across every link inside the MST region, regardless of the VLAN assignment to the actual
port.
* By default All VLANs belongs to IST, unless explicitly moved to other MSTIs
* IST topology influences all VLANs mapped to it.
* If VLAN is accidentally left in IST, it inherits the IST topology instead of the one you intended.
* this can create the unexpected blocking ports.
vlan 10 IST, vlan 20 is MST1, SW1 and SW2 have two parllel links carrying both vlans
links are misconfigured as access ports, due to this vlan configured for IST may stop passing traffic as the
STP blocks one of the two links
* there are two solutions for this scenario
* Move VLAN10 to an MST1 instance other than the IST. the switches will build a topology based on the
links in use by that MSTI.
* Allow the VLANs associated with the IST on all interswitch links.
Trunk link pruning.
* Vlan prunning is a mechanism that stops unnecessary VLAN traffic from crossing trunk links.
* If switch doesnot contain any accessports in a VLAN cisco can prune that VLAN from the trunk so that
the trunk doesnot carry
broadcast/multicast/unknown unicast for that VLAN.
* This reduces
unnecessary traffic
broadcast storms
bandwidth usage on trunks
CPU load on switches.
* Pruning ensures a trunk carries only the VLANs actually needed on the far end.
* VLAN pruning is commonly used for load balancing or reducing unnecessary broadcast traffic.
* inconsistent VLAN prunning across different trunk links may cause
* MST instance toplogy doesnot change
* VLAN forwarding paths do change
* causes mismatches between MST calculations and VLAN availability.
* Incosistent VLAN pruning may casue network outage
* solution is
* Always prune VLANs consistently for all VLANs in the same MSTI
* Allow all the vlans in trunk
* Or, prune all the VLANs from the trunk.
* MST calculates STP based on instance not individual VLANs
MST region boundary
* MST region boundary that connects to
* switch in a different MST region (different name, revision, or VLAN mapping)
* switch running PVST+
* switch running RPVST+
* switch running CST
* switch running RSTP
* IST handles all STP operations inside the region
* Topology for all MST instances contained within the IST

VLAN Trunks and Etherchannels

* VLAN trunking protocol - VTP helps centrally manage VLANs multiple cisco switches
* Dynamic trunking protocol - DTP automatically negotiates whether a link becomes access or a trunk
port.
* Etherchannel bundle - Multiple physical links can be combines to form a logical interface.

VTP - VLAN trunking protocol

* VTP is a cisco proprietary protocol.
* VTP helps centrally manage VLANs multiple cisco switches
* VTP ensures consistent vlan information across switches
* VTP reduces administrative effort
* VTP solves vlan scalability issue by centralizing VLAN database
*
* VTP defines four roles
* VTP server
* server is responsible for the creation, modification, and deletion of VLANs within the VTP domain.
* central authority for VLAN configuration
* Sends VTP advertisements to all switches in the VTP domain
* Stores VLAN information in NVRAM
* Changes made on the server switch updates all clients switches
* VTP client
* Recieves VLAN updates from the server, automatically updates its VLAN database
* cannot create or modify VLANs locally
* Stores VLAN information only in RAM.
* clients are dependent on the server for VLAN management.
* VTP transparent
* DO not participate in VTP synchronization
* Do not modify its VLAN database from VTP messages
* Forwards VTP advertisements through its trunk ports.
* VLANs must be configured locally.
* Transparent switch doesnot advertise its local database to any other switches.
* It acts like a bridge for VTP messages but stays independent.
* VTP Off
* Does not send, recieve, forwards VTP messages
* VLANs are configured locally
* No VTP interaction at all
* Behaves like older switches that dont support VTP
* VTP has three versions
* Version 1
* Default version on most cisco switches
* supports vlan 1-1005 only
* it does not support extended VLAN range (vlan 1006-4094)
* Basic VTP operation : advertisements, database revision number, pruning (optional)
* Version 2
* supports tokent ring VLANs
* forwards TLV (time, length,value) feilds across the domain.
* transparent switches forward VTP messages without modifying them.
* Support normal range of VLANs 1-1005
* Version 3
* This is recommended version for current deployements
* Supports extended range of VLANs 1006-4094
* Adds enhanced security. robust authentication, protection against accidental overwrites.
* Supports MSTI, Private VLANs, additional database types.
* Version 3 introduces the concept of primary server
* Primary server
create, modify, delete VLANs
* vtp primary, the command is used to set the primary VTP server.
* VTP primary is used to prevent accidental changes from any server.
* Other servers behaves like VTPV2 servers, but cannot modify the database unless they are prompted to
primary.
* VTP relies on multicast address to distribute VLAN information to all switches in the same VTP
domain.
* VTP messages are multicast across the trunk links
* Every switch in the VTP domain recieves the updates.
* Updates are processes only if
* domain name matches
* The revision number higher than the local database.
* VTP uses three types of advertisements to manage how vlan changes are communicated.
* Summary advertisements
* Advertisements occurs every 300 seconds
* Immediately when VLAN is added, deleted or changed.
* this includes VTP domain, revision number, VTP version, Timestamp.
* This advertisement is used to anounce the state of VTP database and inform other switches if they need
updates.
* Subset advertisements
* Occurs immediately after a VLAN configuration change occurs
* Used to deliver details VLAN information so switches can update its local VLAN database.
* Provides complete information about each VLAN being changed.
VLAN number, VLAN name, VLAN state.
* It ensures all VTP clients synchronize their databases with the server.
* Client request advertisements
* It occurs when a client detects higher revision number in its summary advertisements.
* Or when a new switch joins the domain and needs the current VLAN database.
* Used to request the full detailed subset advertisement from the server.
Configuring VTP
* configuring VTP involves five main steps
* Define the VTP version with the command
vtp version <1|2|3>
* Define the VTP domain with the command
vtp domain <name>
changing the VTP domain resets the local revision number to 0
All switches in the VTP domain must have same domain name to exchange the updates.
* Define the VTP mode using
vtp mode <server|client|transparent|off>
* configure VTP password to secure vtp domain
vtp password <password>
this is optional but recommended.
prevents unauthorized switches from joining to the VTP domain
ensures all switches share the same authentication information.
* Define the primary server (for version 3 only)
vtp primary
we may have multiple server switches but only the primary server can modify the VLANs
A manual promotion is required. it prevents accidental overwrites.

* Always configure the VTP domain before making VLAN changes.

* Changing the domain name resets the revision number to 0.
* Every switch needs the same domain name and password to sync.
* In VTPv3, only the primary server can modify VLANs.
* Transparent mode passes VTP messages but maintains its own VLANs.
* VTPv3 is recommended for modern networks (supports VLANs 1–4094).

VTP Verification
* VTP verification ensures the VTP domain is healthy and synchronized.
* show vtp status - this is the main command is used to verify the VTP status.
* this command provides most important information about VTP on each switch.
VTP version - should match across the domain, version 3 recommended for modren [Link]
VLAN 1 - 4094
VTP domain name - must be identical on all switches.
VTP operating mode - server, client, transparent, off
Number of VLANS - reflects number of VLANs configured in the domain.
Configuration revision number - It is a most critical value, increments whenever VLANs are added,
changed, removed.
All synchronized switches must have same revision number.
Revision increments = number of changes. not number of VLANs.
VTP revision number
* VTP revision number is a major source for severe network outages.
* if a switch with higher revision number joins the domain with empty or incorrect VLAN database
VLAN database considered newer.
overwrites the VTP servers correct database
All switches in the domain loses their VLANs
Solution
* Before connecting switch to the VTP domain
Always resets its VTP revision number to 0. we can do this by
changing VTP domain and correct it back
setting VTP mode to transparent and correct it back
Erasing NVRAM is needed
reloading after clearing VTP config.
DTP - Dynamic trunking protocol
* DTP is a cisco proprietary protocol used to automatically negotiate the trunk link formation between the
switches.
* DTP allows trunking to be established dynamically when both ends agree to form a trunk.
* Trunk ports carry multiple VLANs between connected devices.
* When DTP is configured
* switch port sends DTP frames every 30 seconds.
* if the negotiation succeeds port becomes [Link] side anounces its willingness to form a trunk
* If compatible, link becomes trunk automatically.
* Both ends must be in the same VTP domain for DTP to work.
* DTP continues sending frames every 30 seconds to maintain awareness of peer status.
DTP Port modes
* Trunk Mode
* This mode statically places the switch port as the trunk port
* in this mode, switch port sends DTP packets to the other end to establish a dynamic trunk. Attempts to
form a trunk with neighbor
* Forms a trunk with almost any mode except nonegotiate.
* switchport mode trunk - this command is used to place the switchport in trunk mode.
* Dynamic desirable
* this mode actively attempts to form a trunk
* starts as an accessport
* sends and listens for DTP frames to the other end to form a dynamic trunk
* in successful negotiation port becomes trunk
* switchport mode dynamic desirable - command is used to put the switchport in this mode
* Dynamic auto
* This mode is passive
* this mode doesnot actively try to form a trunk, it waits for the other switch to initiate the trunk
negotiation.
* starts as an accessport, only listens for DTP frames, Does not intiate the trunk formation.
* Becomes a trunk only if neighbor actively tries to form.
* DTP success matrix
* DTP general rule - A trunk forms unless both sides are dynamic auto mode.
trunk --- trunk ..... trunk forms
trunk --- desirable ... trunk forms
desirable --- auto ... trunk forms
desirable--- desirable ... trunk forms
auto --- auto ..... no trunk
* switchport nonegotiate commands disables DTP on a trunk.
* show interface trunk - this commands displys the output for trunk link.
auto - dynamic auto
desirable - dynamic desirable
on - static trunk
* Switchport nonegotiate is used to
* security - prevents accidental or malicious trunk formation
* Required when connecting to non-cisco devices - firewalls, servers, hypervisors that dont support DTP
* Prevents unintended negotiation surprises.
* Best practice is to configure both ends of a link with a fixed port type - avoid DTP.
switchport mode access
switchport mode trunk
Ether channel Bundle
* Etherchannel is used to bundling multiple physical links into one logical link. it allows increased
bandwidth.
* If the link becomes saturated, you need more bandwidth to prevent packet loss.
* if multiple cables added between switches, STP blocks redundant links to avoid loops.
* upgrade to faster ports often not feasible due to
hardware limitations
cost
Port availability.
* Etherchannel bundles multiple physical links into one logical link.
STP views the etherchannel as one [Link] it does not block individual member interfaces.
Simpler and faster convergence
Total bandwidth is the sum of all active member links.
traffic is load balanced across the links.
works in
Layer 2 - access or trunk ports
Layer 3 - routed ports
Etherchannel/ Port channel - The logical bundled interface.
Member interfaces - Physical interfaces that participates in the bundle.
* Reduced topology change impact - Stability
if one physical member link fails
the etherchannel remains up as log as one link is still active
Stp does not recalculate
Routing does not change
* Increased bandwidth
* STP efficiency
* There are two ways to form an etherchannel
* Static etherchannel
* Manually forces interfaces into an etherchannel
* No health checking between switches
* No negotiation with other switches
* If the link is partly broken but still shows as online, it may cause traffic to be forwarded incorrectly.
* Dynamic etherchannel
* uses a link aggregation protocol
* There are two types of link aggregation protocols
PAgP - Port aggregation protocol
LACP - Link aggregation protocol
* It ensures end-to-end detection and integrity
* It automatically disables failed link
* it prevents packet loss
* Detect failures across transport devices.
* Static etherchannels can cause packet loss due to
* consider two switches connected via a DWDM optical gear using two physical links
* A failure between DWDM-1 and DWDM-2 may not propagate back to SW1 or SW2.
* STP wont block anything
* static mode checks only local physical state. so switches thinks link is still up.
* switch continues loadbalancing traffic. packets sent through the failed path are lost.
* static etherchannel has no end-to-end health check.
* Dynamic etherchannel fix this as follows
* Protocols monitor end-to-end connectivity
* LACP sends protocol negotiation frames across the entire path
* if a link fails
* LACP stops recieving PDUs on that interface
* Member interface is removed from the etherchannel
* No traffic is forwarded on the failed path
* No packet loss
* Dynamic link aggregation protocols
* Etherchannel bundles can be formed dynamically using PAgP or LACP
* These protocols negotiate, validate and maintain etherchannel links. ensures only healthy links
participate.
* All member ports should use same protocol on both sides to establish a etherchannel
* PAgP - Port aggregation protocol
* it is a cisco proprietary protocol
* It uses multicast MAC address - [Link]
* Exchanges packets to negotiate and maintain etherchannel
* Detects link consistency (speed, duplex, VLAN, trunking etc)
Modes
* Etherchannels can be configured in three modes
* Static
* PAgP
* LACP
* All member interfaces participating in the same etherchannel must share identical settings. or otherwise
bundle will fail
and the ports will be placed into suspended/inconsistent [Link] are
Speed - must use same speed
Duplex - must run same duplex mode. mismatching will block the port from joining the channel.
Switchport mode - All ports must be either access or trunk
Access - same access vlan must be configured
Trunk - Same allowed vlan list, same native vlan, same encapsulation
Vlan settings - access vlan, allowed vlans, native vlans.
MTU - jumbo-frame environments require identical MTU on all ports.
Flow control - same flow control settings (send/recieve, on/off)
Port channel protocol + Mode - Must use same protocol - static, LACP, PAgP. Mode must be compatible -
(active/pasive - desirable/auto).
Spanning tree settings - portfast on/off must match. guard/root/loop settings must match. BPDU
guard/filter should match.
Storm control settings - unicast/multicast/broadcast control levels must be identical.
Load-balancing hash method (Switch-wide)
physical media type
interface state.
* channel-group <id> mode <mode-type>
this is interface specific command is used to configure etherchannel
* mode on - is used to configure static etherchannel
Static etherchannel does not use any negotiation protocol
Both sides must be set to on
* mode {active|passive} - is used to configure LACP etherchannel
it uses LACP 802.3ad negotiation
* mode {desirable|auto} - is used to configure PAgP etherchannel
By default PAgP ports run in silent mode
in this mode port establish etherchannel with a device that is not PAgP capable and sends packets rarely.
In silent mode port forms etherchannel irrespective of PAgP packets
this mode can be used when connecting to non-cisco device with no PAgP, connecting devices that do not
transmit PAgP packets
consistently.
non-silent keyword is used to change the PAgP mode from silent mode to non-silent mode.
In non-silent mode, the port must recieve PAgP packets before forming etherchannel. if no PAgP packets
recieved the port doesnot form an etherchannel
It prevents accidental or misconfigured channel information.
This mode ensures that both ends are running PAgP actively and correctly.
this mode can be used when connecting cisco switch to cisco switch, for faster negotiation and reliable
link validation, to avoid accidental
bundling with non-PAgP devices.
in this mode link will be established more quickly than silent mode.
channel-group 1 mode desirable non-silent
channel-group 1 mode auto non-silent
* Configuration settings for the etherchannel will placed in the port-channel interface.
* Before adding interfaces to the channel group, member interfaces must be in the appropriate L2 or L3
mode
* Member interface type dictates whether the etherchannel operates at L2 or L3.
Verification
* After configuring Etherchannel, we must verify that
* Etherchannel is successfully configured or not
* All member interfaces bundled correctly
* Protocol - LACP/PAgP/static
* No misconfiguration or suspended links
* show etherchannel summary
* command provides overview of
* List(overview) of all port-channels
* Status and protocol in use for each port-channel
* All assined member interfaces
* Each members state (up/bundled/suspended)
* Output displays etherchannel status. it should be SU - means L2 etherchannel and it is UP. it is
operational and forwarding traffic.
* Etherchannel interface status feilds
* U - Etherchannel interface is working properly
* D - Etherchannel interface is Down
* M - Etherchannel goes into M, when
The etherchannel establishes LACP adjacency, But the number of active/bundled member interfaces is
less than
minimum requirement
Port-channel stays up but the traffic forwarding is disabled.
command - port-channel min-links min-member-interfaces
* S - Etherchannel interface is configured for switching
* R - Etherchannel interface is configured for routing
* Etherchannel member interface status feilds
* P - interface is actively participating and forwarding traffic for this etherchannel.
* H - The member interface is participating in LACP but is not actively forwarding traffic because the
etherchannel has
reached its configured maximum number of active links.
Hot-standby interfaces are negotated and ready but do not forward traffic.
Reasons
it prevents overloading upstream and downstream devices
Maintain QoS shaping or policing requirements
Keep consistent bandwidth for routing decisions
save power or port resources
command - lacp maxbundle number-member-interfaces
* I - Member interface has not detected any LACP activity on this interface and is treated as individual.
* w - There is time left to recieve a packet from this neighbor to ensure that it is still alive.
* s - member interface is in suspended state.
* r - the switch module associated with this interface has been removed from the chassis.
* Verifying the Etherchannel
* The logical interface (Port-channel) behaves like a single physical interface.
show interface port-channel <PO id>
* The command is used to verify
* Operatitonal status of Etherchannel
* Combined bandwidth of all active member interfaces
* Interface statistics (Packets, error, drops)
* List of member interfaces
* Parameters referenced by other systems (QoS, routing protocols)
* Key information in the output
* interface status
this confirms the etherchannel is operational at the interface level
* Bandwidth value
* bandwidth shown on the port-channel interface equals to sum of bandwidth of all active member
interfaces.
* the port-channel bandwidth is not cosmetic, it is actively used by
* QoS policies (shaping, policing, scheduling)
* Routing protocols (OSPF, EIGRP, interface cost calculations)
* traffic engineering decisions
* If a member link goes down
* port-channel bandwidth automatically decreases
* QoS and routing protocols adjust dynamically
* QoS and routing protocols rely on this bandwidth value
* No manual recalcultions is required.
* Member interfaces listed
* All physical interfaces in the etherchannel
* confirms which links are contributing to the logical interface
*
* Viewing etherchannel neighbors
* Dynamic etherchannel protocols (LACP and PAgP) exchange control packets that carry valuable
information about the remote device.
* These protocols include a lot of useful information that heps identify incosistencies in configuration.
* show etherchannel port
* this command shows detailed etherchannel information derived from
* local interface configuration
* Recieved LACP or PAgP packets
Key points in the output are
* Etherchannel group membership
* Protocol in use (LACP or PAgP)
* Local and remote system IDs
* Port states and flags
* timers and negotiation details
* used for deep troubleshooting
* useful when etherchannel doesnot form
* Links are suspended or inconsistent
* when we need to see exact protocol negotiation details
* Cisco provides protocol specific neighbor commands that give brief and trageted information for faster
troubleshooting.
* show lacp neighbor
* This commands displays information about LACP neighbors
* Key information
* Neighbor system ID
* Neighbor system priority
* Local and remote ports
* LACP timer mode (fast or slow)
* it cofirms that all member interfaces connect to the same remote device
* Helps to identify the cabling errors or split connectiors
* Verifies LACP timing behaviour
LACP system ID
* it uniquely identifies a device participating in LACP
* All member links in an etherchannel must connect to a same LACP system ID.
* If system ID differs
* Etherchannel will not form
* Links may be suspended or independent
* show lacp sys-id
* this command displays the local switch LACP system identifier.
* used to compare system ID which what neighbors report
* verify device identify in mutlti switch topologies
* troubleshoot etherchannel incosistencies
* Very useful in diagnosing miwired or cross connected links
PAgP Neighbor verification
* show pagp neighbor
* displays information about PAgP neighbors
* Key information
* neighbor system ID
* remote port number
* PAgP timer mode (fast or slow)
* confirmation of PAgP adjacency
* It ensures bot sides running PAgP
* confirms correct port-to-port connectivity
* Helps detect mismatched configurations
* fast packet interval - 1 second - faster detection of failure
* slow packet interval - 30 seconds - lower overhead, slower detection
* failure detection speed
* convergence behaviour
* troubleshooting expectation
* show etherchannel port - Detailed etherchannel inspection
* show lacp neighbor - quick LACP neighbor check
* show local sys-id - verify local LACP identity
* show pagp neighbor - quick PAgP neighbor check
* Troubleshooting checklist
* ALl member interfaces show same system ID
* correct protocol is used on both ends
* No mixed neighbor identities
* Packet interval expectations match (fast/slow)
* physical cabling alligns with logical grouping
Verifying etherchannel packets
* Verifying etherchannel packets is a critical troubleshooting step used to verify the etherchannel sttaus
* if the control packets are not flowing correctly, the etherchannel cannot negotiate or stay healthy.
* Dynamic etherchannels rely on LACP, PAgP control packets.
* These packets establishes etherchannel, maintain link health, detect failures and incosistencies.
* if packets are not sent and recieved, etherchannel fail to form, partially formed or places interfaces into
suspended independent or standby states.
* show etherchannel summary - verify etherchannel status
* show lacp/pagp neighbors - verify neighbors
* show lacp/pagp counters - verify protocol packet counters
* check physical links and configuration mismatches.
* LACP packet verification
* show lacp counters
* this command displays LACP packet statistics for each port-channel or for each member interface
* output includes
* port-channel ID
* member interfaces
* LACP packets sent and recieved
* error counters
* interface should see sent and received counters increments. this confirms
* physical connectivity
* correct LACP configuration
* Bidirectional packet exchange.
* if counters do not increment, it indicates a problem.
* it could be related to physical link
* Remote interface miscongiguration
* Remote interface not running LACP
* Protocol mismatch (static vs LACP, wrong mode)
* incomplete or incompatible configuration with the remote device.
* Next step is to check LACP counters on the remote switch to confirm whether it is transmitting packets
or not.
* clear lacp counters - this command is used to clear LACP counters
* PAgP packet verifictaion
* show pagp counters
* this command is used to display PAgP packet statistics for each etherchannel or for each member
interface.
* Output includes
* port-channel ID
* Member interface
* PAgP packets sent or received
* error counters
* clear pagp counters - PAgP counters can be cleared using this command
* Verify PAgP counters
* confirms whether PAgP packets are exchanged correctly
* this helps to identify
* Protocol negotiation issues
* silent vs non-silent behaviour
* Remote device compatibility problems
Advanced LACP configuration
* LACP is an link aggregation protocol is used to bundle multiple physical links to an single logical link
called a port-channel
* LACP dynamically negotiates link aggregation
* LACP detects link failures
* Ensures only compatible interfaces are bundled
LACP is open standard and provides advanced configuration options than PAgP
LACP timers
* LACP works by exchanging LACP data units packets between membet interfaces
* If LACP packet stop arriving
* link considered failed
* the interface is removed from the port-channel
* the timer interval determines how fast failures are detected.
Default LACP behaviour
* LACPDU sent every 30 seconds
* link is declared down after 3 missed packets
* failure detection time 90 seconds - packet loss for a link before that member interface is removed from a
port channel
Impact
* Long convergence time
* packet drops
* not suitable for modern or high availability networks
LACP fast
* LACP fast is an enhancement to the default LACP that reduces the failure detection time
* LACPDU sent every 1 second
* Link removed after 3 missed packets
* failure detection time 3 seconds
Benifits
* faster convergence
* reduced packet loss
* High-availability behaviour
* LACP fast is enabled on per member interface not on the port-channel
* Must be configured on each physical interface in the bundle
* Best practice is to enable on both ends
* lacp rate fast is the command is used to enable LACP fast
Negotiation behaviour
* LACP timers are negotiated between peers. one side LACP fast and other is slow, the slow timers is
usually used.
Verifying LACP fast operation
* show etherchannel detail
* show lacp neighbor
* show port-channel summary
look for
* timeout - short or fast
* Member interfaces in bundled state
* no churn or mismatch flags

* LACP fast doesnot affect which interfaces are selected, it only effects how fast interfaces are removed
once they are failed and how fast traffic reconverges
* Member slection is depends on system priority, port priority, MaX bundle size, interface compatibiltiy
(speed, duplex, VLANs, MTU)
Minimum number of Etherchannel member interfaces
* By default, etherchannel becomes up as soon as one member interface successfully forms an adjacency
with remote device
* In some network, bringing up etherchannel with only one interfaces is undesirable
* So, minimum links feature is used to address this feature. it only brings etherchannel up when it meets
minimum number of active member links forms an adjacency with remote device.
Minimum links feature is used to
* prevent partial bandwidth availability
* ensure design consistency in high-availability networks
* avoid traffic forwarding when redundancy requirements are not met
* protect upstream/downstream devices from unintended traffic pattern
* the minimum links requirement is configured on port-channel interface
* port-channel min-links <min-links> - this command is used to configure minimum links requirement on
port-channel
* this configuration requires atleast two active LACP adjacencies before port-channel becomes
operational
* if active links drop below the minimum, port-channel shows status as not in use.
* show etherchannel summary
* displays
* port-channel state : down, not-in-use
* member interfaces may still show up
* no traffic forwarded to the port-channel
* The minimum number of etherchannel member interfaces does not need to be configured on both
devices to work properly.
Maximum number of etherchannel interfaces.
* An etherchannel can be configured to have more physical interfaces configured than the interfaces are
allowed to actively forward traffic.
* using LACP, maximum number of active member interfaces can be defined for a port-channel
* ensures
* predictable forwarding behaviour
* controlled redundancy
* consistent load-balancing efficiency
* lacp max-bundle - this feature is used to configure maximum number of memeber interfaces in an
etherchannel
* Max-bundle size feature commonly used for
* ensure number active links remains in power of 2
* inprove has-based load balancing
* provide hot-standby links for redundancy
* maintain standared forwarding behaviourin campus and data center designs
* lacp max-bundle <number> - this feature is configured on port-channel for maximum number of active
member interfaces
* this feature limits the number of active member interfaces to specific value even if more are available.
* If more physical interfaces are eligible than the configured maximum value
* only the preffered interaces become active, remaining interfaces enter into hot-standby mode
* Hot-standby interfaces are
* participates in LACP neotiation
* do not forward traffic
* automatically become active if an active link fails
* Hot-standby state
* extra links are placed into hot--standby, these links are fully negotiated via LACP ut doesnot selected
for forwarding
* the maximum number of etherchannel member interfaces needs to be configure only on primary switch
for that port-channel.
* the etherchannel primary switch controls
* which interfaces are active, which interfaces are placed in hot-standby
* the selection is based on LACP port priority and interface number (lower values preffered)
* only the primary switch is required to enforce lacp max-bundle.
* However cisco recommends configuring it on both sides to
* simplify troubleshooting
* reduce operational confusion
* improve consistency and visibility.
* if one active link fails, hot-standby interfaces automatically promoted.
LACP system priority
* LACP system priority determines which switch becomes the primary switch for an etherchannel
* Primary switch is responsible for selecting which member interfaces become active and hot-standby
* the switch with the lower system priority value is preffered
LACP system priority is used when
* multiple switches participate in an etherchannel
* the etherchannel has more physical interfaces than allowed
* decision must be made about which links are active vs hot-standby
* Primary switch controls
* controls member interface selection
* Determine interfaces ststus (active, stand-by)
uses LACP port priority and interface number to make decisions
* LACP determines primary using
* lower system priorty
* lower system MAC
* default LACP system priority is 32768
* lacp system-priority <value> - command is used to configure LACP system priority
* configure system priority manually
* control operational behaviour
* avoid unpredictable primary switch elections
important in
* large campus and datacenter environments
* etherchannel with many member links
* show lacp sys-id - command displays system priority and system MAC.
LACP interface priority
* LACP interface priority enables primary switch to select which member interfaces are active in an
etherchannel when there are more member interfaces
than the maximum number of interfces for an etherchannel
* Port with lower priority is preffered.
* lacp port-priority <value> - command is used to set the interface priority

Troubleshooting Etherchannel bundles

* An etherchannel is an logical interface formed by bundling multiple physical interfaces
* All member interfaces must have an identical characteristics to form an etherchannel
* if characteristics differs the switch prevent an interface from joining the bundle or place the interface in
suspended state or standalone state.
* when configuring etherchannel, first configure physical interface with port-type and enable LACP or
PAgP.
* assign interfaces to the port-channel
* perform all remaining configuration in the port-channel interface.
* this ensures consistency across on all member interfaces.
mandatory matching parameters
* ALl memeber interfaces must match the follwing parameters
* Port-type - all interfaces must be either L2 or L3. if not is not allowed. inconsistent port mode.
* Port-mode - ALl interfaces must be configured as access or trunk ports
* Native VLAN - All trunk intrfaces must use same native VLAN. mismacth result in etherchannel
failure. possible VLAN leakage.
* Allowed VLAN - All member interfaces must allow the same VLAN list. even one VLAN difference
prevents bundling.
* Speed - All member interfaces must operate at same speed. auto vs hardcoded, mismatching speed
settings will not form etherchannel
* Duplex - Duplex must match across all member interfaces. full/half mismatches prevent the interface
from added to the bundle.
* MTU - All L3 interfaces must have same MTU. if differs interfaces is rejected from the port-channel
* Load interval - load interval must be identical on all member interfaces.
* storm control - storm control settings must match exactly. ( broadcast, multicast, unicast).any mismatch
can suspend interface from the bundle.
* Link scope - each member interface must connect to only one remote device. etherchannel wont support
hub-style connections
* Interface state - all member interfaces must be admin up, operationally up.
* ensure correct protocol allignment
static - both sides must be on
LACP - at least one side set to active
PAgP - at least one side set to desirable
* configuration consistency - ALl member interfaces must be configured identically. LACP pport priority
allowed to be different
* Protocol packet verification - LACP or PAgP packets are being sent. packets are being received on both
ends.
* suspended - config mismatch , standlaone - protocol mismatch or negotiation failure
Load balancing traffic with Etherchannel bundles
* Etherchannel doesnot perform per packet load balancing across member interfaces
* traffic is distributed using the hashing algorithm that is calculated from the selected packet header fields
* All packets that result in the same hash value are consistently forwarded over same physical member
link
* this preserve packet order, prevents L2 or L3 reordering issues, ensures flow based consistency.
* Etherchannel load balancing is flow based not packet based
* Traffic is not forwarded out on a round-robin basis per packet.
* Hash is calculated using selected packet fields
MAC address, IP address, TCP/UDP ports, or combination of above.
* Hash value determines which member interface forwards that flow.
* ALl packets belonging to the same flow follow the same physical link.
* Etherchannel load balancing is system wide configuration. it applies to all port-channels on the switch.
* Port-channel load-balance <hash> - this is global config command.
* common list of hash options below. newer IOS XE versions include VLAN number as part of hash.
* src-mac - source MAC address
* src-dst-mac - source and destination MAC address
* src-ip - source IP address
* src-dst-ip - source and destination IP address
* src-dst-ip-only - source and destintion Ip addresses only
* src-port - source TCP/UPD port
* dst-port - destination TCP/UDP port
* src-dst-port - source and destination TCP/UDP port
* src-mixed-ip-port - source IP address and source TCP/UDP port.
* dst-mixed-ip-port - destination IP address and destination TCP/UDP port
* src-dst-mixed-ip-port - source and destination IP address and source and destination TCP/UDP ports
* The choice of hash field directly affects the traffic distribution.
* if etherchannel connects to a router, MAC based hashing results in Poor load distribution, one heavily
used link due to router uses a single MAC.
* Better choice is to use source/destination IP, TCP/UDP port based hashing.
* if traffic appears uneven
* etherchannel itself is not broken, hash algorithm may not suit the traffic pattern.
* changing the hash methode can alter the distribution
port-channel load-balance src-dst-ip
* show etherchannel load-balance - command displays how switch will load balance the traffic based on
its type
non-IP, IPV4, IPV6
* show etherchannel port - this command displays
* load on each memeber interface
* link utilization shows in hexadecimal
* used to verify traffic destribution
* this is preffered command to verify actual load per link.
* Etherchannel hashing uses binay function. so links should be power of 2 to be consistent.
* hash results divide evenly, traffic distribution is more consistent.