Luke Evans Networks

Networking Blog

Contact

  • NetFlow & Syslog

    +

    +

    +

    +

    +

    +

    My last post I went over SNMP (check it out) this post I’m going to put these 2 topics together instead of breaking them up. I’ll go over NetFlow first and syslog second.

    NetFlow

    The way NetFlow was explained to me was saying it’s like your bank account statement for your network traffic. Such as What you spend money on, where it came from, when it happened how much was transferred and the type of transaction. With NetFlow you can it will router identify information from the following:

    • Source IP
    • Destination IP
    • Source port
    • Destination port
    • IP protocol
    • Number of packers
    • Number of bytes
    • Input interface
    • Output interface
    • Timestamps

    An example of a flow would be the Source IP – Destination IP – Source port – Destination Port – Protocol

    Having access to see flows like this is if you’re hearing that the network is slow you can look at the flow and see this IP address is sending a lot of traffic to this IP address using port 445 than you know someone is doing a large file transfer, or if you are seeing a large amount of 443 traffic you can tell someone is using a lot of internet traffic and go about your troubleshooting, you can also use this information to setup security alerts based on amount of traffic and port numbers, such as a server is generating large amount s of outbound traffic that normally doesn’t, unexpected connections to a unusual number of external IP addresses. It’s very help to see your top talkers, applications, protocols and endpoint devices that are consuming bandwidth.

    NetFlow versions

    There are 9 versions of NetFlow, I’m not going to cover all of them. Cisco is the company that developed NetFlow that started with version 1, Version 5 was mostly used for legacy  devices and now version 9 is the most widely used allowing other companies that use NetFlow or their own version of NetFlow, such as juniper has their JFlow, Fortinet uses NetFlow v9 which has to be configured via CLI.

    Components of NetFlow

    3 components make up NetFlow such as your Flow Exporter, Flow Collector and Flow Analyzer:

    Flow Exporter: This would be a Network device such as a Cisco router or Cisco Switch that is running IOS, IOS-XE or NX-OS. The Exporter inspects the packets creates and updates the flow record in catch and experts them using UDP using port numbers 2055 or 9996.

    Flow Collector: This is a server/software application that receives, stores and processes the flow data. Collectors can handle data if multiple exporters send the same flows and manage high volumes of Data. These applications are software such as SolarWinds, PRTG. Myself in my home lab I have PRTG setup on my network monitoring lab. Flow Analyzers: The application such as SolarWinds or PRTG that takes the collected data and makes it readable for reports, alerts and creates easy to ready visualization.

    Configuring NetFlow on Cisco

    This is the my network topology for my monitoring lab

    This is the configuration I have setup on my Monitoring lab

    LT-R1(config)#flow record NEWFLOW-RECORD
    LT-R1(config-flow-record)# match ipv4 source address
    LT-R1(config-flow-record)# match ipv4 destination address
    LT-R1(config-flow-record)# match ipv4 protocol
    LT-R1(config-flow-record)# match transport source-port
    LT-R1(config-flow-record)# match transport destination-port
    LT-R1(config-flow-record)# collect counter bytes
    LT-R1(config-flow-record)# collect counter packets
    LT-R1(config-flow-record)# collect timestamp absolute first
    LT-R1(config-flow-record)# collect timestamp absolute last

    This first sent of commands is creating a flow record and telling what I want to match and collect as you can see we are doing IP source/destination protocol, source & destination port, the number of bytes and packets and the time stamps.

    LT-R1(config)#flow exporter NETFLOW-EXPORTER
    LT-R1(config-flow-exporter)#destination 10.10.10.30
    LT-R1(config-flow-exporter)#source gi0/0
    LT-R1(config-flow-exporter)#transport udp 2055
    LT-R1(config-flow-exporter)#template data timeout 60

    These commands configure the NetFlow Exporter traffic to the Flow Collector / Flow Network analyzer at the IP address of 10.10.10.30 using port 2055 and it’s going to send it every 60 seconds

    LT-R1(config)#flow monitor NET-FLOW-MONITOR
    LT-R1(config-flow-monitor)# exporter NETFLOW-EXPORTER
    LT-R1(config-flow-monitor)# cache timeout active 60
    LT-R1(config-flow-monitor)# record NEWFLOW-RECORD

    This creates the NetFlow monitor and ties everything together it defines what data is collected via the flow record and where it is going to be sent from the NetFlow Exporter and if the flow is a still active the router will exporter the flow record every 60 seconds.

    LT-R1(config)#int gi0/0-1
    LT-R1(config-if-range)# ip flow monitor NET-FLOW-MONITOR input
    LT-R1(config-if-range)# ip flow monitor NET-FLOW-MONITOR output

    LT-R1(config)#int gi0/1
    LT-R1(config-if-range)# ip flow monitor NET-FLOW-MONITOR input
    LT-R1(config-if-range)# ip flow monitor NET-FLOW-MONITOR output

    The last commands are used to apply the monitoring to the interfaces.

    Troubleshooting NetFlow

    Use the following commands to help troubleshoot NetFlow

    show flow exporter – lets you verify things such as exporter name, destination IP, source interface, protocol, port number. Etc.

    show flow monitor NET-FLOW-MONITOR – Monitor exists, Record being used, Exporter, cache configuration and flow stats.

    show flow monitor NET-FLOW-MONITOR cache – shows the flows that the router is currently tracking.

    show flow record NEWFLOW-RECORD – shows the flow record defines what information Cisco collects.show running-config | section flow – Check the configuration of NetFlow in your running configuration.

    show running-config | section flow – Check the configuration of NetFlow in your running configuration.

    Syslog

    Syslog is a centralized storage system for all devices that have logs from all devices. When there is an issue on the network and you need to log at the log files or if your normal morning task is to check to see if anything happened on the network overnight, instead of logging in to each device one at a time and looking thought all the logs on all your devices could take all day. Having everything sent to one server where you can view all the logs in one place is very helpful and especially when some devices like Cisco has their log files deleted on a reboot.

    Syslog uses port 514 both with UDP and TCP. You can setup a secure version of syslog by sending system messages over TLS but I’m going to show you the basic way for syslog on a Cisco device again this is something you can secure with ACLs and not normally traffic that leaves the network. In real world you want to make this secure.  

    For my home Lab, I just run Visual Syslog Server on the same server I run PRTG, but having a syslog, netflow and SNMP all in one application is very nice to have on something like SolarWinds, I haven’t spend a lot of time turning up a syslog server with PRTG that might be something I might look in to down the road.

    Configure Syslog on Cisco devices.

    LT_R1(config)#logging host 10.10.10.30

    This sends all logs to 10.10.30.

    You can also dig into setup up the configuration to send only certain logs to the syslog server.

    Examples where I’ve had syslogs come in handy for is when seeing who made changes to a router config last, finding a Native VLAN mismatch, and normally just a normal task in the morning to see if anything has happened on the network over night or over the weekend or after a major network change.

    Here’s an example of a screen shot from my sys log server.

    Conclusion

    Conclusion Having these 3 protocols of SNMP, NetFlow and Syslog is a great hybrid network monitoring model and allowing your network monitoring to be accurate and being able to reduce a lot of noise and pinpoint the problem happening on the network is key. Let me know if you have any questions, thoughts or topics you’d like to see me go over.

    +

    +

    +

    +

    +

    +

    + , ,
    + , , , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • SNMP

    +

    +

    +

    +

    +

    +

    My last post I talked about Network monitoring and the how important network monitoring is and how it is important to have accurate network monitoring. In this post I’m going to go over SNMP (Simple Network Management Protocol (SNMP). SNMP makes it so a tech can know what’s going on within the network without having to login to every single device, picture having a large network with over 100 devices and not having any idea what is going on within the network.  SNMP lets you see device status, interface stats, CPU/memory stats. Most network devices have the capability to be configured with SNMP from your firewalls, routers, switches, wireless, servers, printers, UPS and some IoT devices, devices like unmanaged switches do not have the ability to be configured with SNMP given the name unmanaged.

    SNMPv2 uses UDP and port 161 & 162.

    161 is used for polling, responses between the SNMP manager and the agent (Get, GetNext, Set commands, etc)

    162 is used for notifications, alerts and event logs and traps

    There are 2 different versions of SNMP which are SNMPv2 and SNMPv3 – SNMPv3 is put in the place to improve security features such as authentication, encryption and access control. SNMP is highly recommend now of days, in my professional experience I still am seeing a lot of companies using SNMPv2 and I think you’ll see still see that for a while some older routers/switches do not support SNMPv3 and yes a lot of companies are still running very old devices out there.

    SNMP works using a client/server module that makes up as SNMP manager, managed device and SNMP agent as well as MIBs (Management Information Base) and OIDs. (Object Identifiers).

    SNMP Manager – Is the software normally runs on a windows server or windows or Linux environment. Some of the most popular ones are SolarWinds, PRTG and Zabbix. I use PRTG and Zabbix in my home lab. These applications are polling the network devices and receiving the alerts from the devices and normally have a web GUI that the tech can login to see what’s happening with the network.

    Managed devices – would be your Cisco routers, switches, servers and all the devices I’ve named above.

    SNMP Agent – Is the software running within those managed devices such as CPU/Memory usages, Interface status, Fan speeds, device temperature, power supply status.

    MIB – is the hierarchical database of the managed objects, MIBs are not the data itself but it is how the data is structured using the Structured of management information (SMI) language (I did have to look this information up. There are common MIBs such as interface MIBs, as well as vendor-specific MIBs written for proprietary hardware and can be uploaded into the SNMP Manager. I’ve worked with vendor-specific for some software that would monitor scan through a number of TV channels for a cable provider that would scan and alert for if any channels had a black screen or the audio was too low which also took some fine tuning to avoid false flags if there was a dark sense in a show or if the channel was off air late at night.

    OIDs is the unique dotted decimal string that addresses the specific variable in the MIB tree.  For example the OID for an interface status is 1.3.6.1.2.1.2.2.1.8 & 1.3.6.1.2.1.2.2.1.7 for the admin status of the interface. The image above shows an example how you get the OID numbers from the MIB tree to get to the interface status

    SNMP communicates between SNMP server and Managed devices / agents with the following

    GetRequest – Retrieves the value of one or more specific OIDs

    GetNextRequest – used for table traversal, enables the manager to walk entire tables without knowing all instance IDS in advance

    GetBulkRequest – An effect way to retrieve large amounts of data in one request significantly reducing overhead compared to GetNext operations.

    SetRequest – modifies the value of a writeable object that if SNMP is ReadWrite is configured and can be used to update an interface description or disabling and enabling and interface depending on configuration and permissions on the device and the manager.

    Response – agent’s reply containing requested values or error status.

    Trap – Unsolicited notifications sent from agent to manager when significant events occur such as interface down, device failure, high CPU unitization. Used for real time alerting

    This commutation has very little overhead and is normally setup on its own management network with management VLANs and subnets to segment from other traffic on the network, a lot of causes it’s also setup with the lowest priority for QoS.

    Configuring SNMPv2 example on Cisco

    This is a simple SNMPv2 that used in Cisco and I will break down each command.

    snmp-server community EVANSNETWORKS RO 1
    snmp-server location – Rack 2-U3-LT_R1
    snmp-server contact – Network Admin Networkadmin@example.com
    snmp-server host 10.10.10.5 informs version 2c EVANSNETWORKS

    snmp-server community EVANSNETWORKS RO 1

    To explain the configuration EVANSNETWORKS is the community string, which is like a plain text password that you configure on both the managed device and the SNMP Manager. This is simple example of a community string; you would want to use something more complex text this is just for an example for this post to prefect people from being able to guess it. The RO stands for Read-only if it was RW it would be Read-write and the 1 is the access list allowing access with this community string. I’m not going to get in to how to configure the access list for this in this post.

    snmp-server location – Rack 2-U3-LT_R1
    snmp-server contact – Network Admin Networkadmin@example.com

    The next is location and contract this are optional and do not need to be configured however I would recommend it as a lot of the SNMP managers will have a spot for the contract some have a build in map that you can put the address or longitude and latitude and that device will show up on map.

    snmp-server host 10.10.10.5 informs version 2c EVANSNETWORKS

    The next command is the host command with the IP address of the SNMP Manager followed by what you are sending I have informs in this example but you can have traps instead and than the version of SNMP and the community string.

    Configuring SNMPv3 on Cisco

    To configure SNMPv3 is a lot different than configuring SNMPv3. Here are the commands and I’ll do by best to break down the commands.

    snmp-server group NETWORKADMIN v3 priv read HELPDESK access 1
    snmp-server user luke NETWORKADMIN v3 auth sha cisco priv aes 256 security access 1
    snmp-server host 10.10.10.5 informs version 3 priv luke

    snmp-server group NETWORKADMIN v3 priv read HELPDESK access 1

    creating a group called NETWORKADMIN with SNMP v3 and priv uses encryption users in this group must authentication and encryption. The read HELPDESK assigns a read-only view named helpdesk to this group and is used to control what OIDs members of this group can are allowed to read. I’ll explain how to configure that at the end and the access list 1 again, I’m not going to show how to configure the access lists in this part.

    snmp-server user luke NETWORKADMIN v3 auth sha cisco priv aes 256 security access 1

    This creates a username (luke) and assigned it to the group of NETWORKADMIN that was created in the 1st command. The v3 tells it that we are using SNMPv3 than the Authentication protocol we are using is SHA with the password of cisco (again this is only for a lab/testing you would use a more secure password) with priv aes 256 encryption and than followed by access list 1 which is the access list.

    snmp-server host 10.10.10.5 informs version 3 priv luke

    This command configures the managed device a cisco router in this case to send traps to the SNMP manager at IP address 10.10.10.5 and it’s going to send informs again like in V2 you can also send traps than followed by the version of SNMP and than that it is using authentication + encryption and the user that is configured with the auth/priv settings to send these informs to the server.

    To configure with the Helpdesk group that they are allowed to read OIDs members you configure that with the following command. The interface included command will allow the status and statistics of the interfaces. you can also do system included etc there’s a list.

    snmp-server view HELPDESK interfaces included

    Here is another example configuring SNMPv2 & SNMPv3 on a FortiGate which is a little bit more straight forward and similar using the GUI than CLI

    SNMPV2

    SNMPV3

    Troubleshooting SNMP

    Most of the troubleshooting with SNMP is checking the configuration, check connectivity to between the managed device and the SNMP manager, checking access lists to make sure none of the subnets are being denied or port 161 or 162 is not being denied. On cisco devices you can do basic show commands

    show snmp – will show overall SNMP status and statistics.

    show running-config | section snmp – check the SNMP configuration on the router.

    Using WireShark or any type of packet capture is a great way to make sure your devices / SNMP manager is getting the SNMP traffic.

    You can do an SNMP walk on some devices to test outside of the SNMP manager with the following command

    snmpwalk -v2c -c EVANSNETWORKS 10.10.10.5 system

    Conclusion

    Overall SNMP is a very powerful tool for network monitoring & network management allowing to bring all the monitoring and management into one single tool and being able to have visibility across your network no matter the size of your network or how complex of network you have if you have 5 devices or over 1000 devices. Creating accurate network surveillance/monitoring and management will help you a lot with your network and help with troubleshooting and being able to create alerts and creating custom alerts that you’re able to get via email or SMS or just a pop on your screen will help keep you on top of your network and help with any future issues. Having an alert that your main ISP link is always hitting 90% usage during the day and making the case that it needs to be upgraded or if a hard drive on a server is getting full and needs log files removed or backed up. Being able to see an alert that your cisco router or switch has a different running config and startup config before a power outage happens or a fan fails. So many reasons to have SNMP setup on your network but also keep in mind SNMPv3 has more security features.

    +

    +

    +

    +

    +

    +

    + , ,
    + , , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • Network Monitoring

    +

    +

    +

    +

    +

    +

    Network Monitoring is a very important part of Networking, it can alert you of problems before they come to be major issues, it can alert you as soon as a problem occurs and helps you pinpoint the issue as long as you have your network monitoring configured properly. If you have a device that goes down and every device behind that goes down and you have over 50 alarms, it’s going to take you a lot longer troubleshooting the issue than having 1 alarm that will tell where the problem is and where to start troubleshooting. 

    Just a little background from my personal experience working in a NOCC with network monitoring for an ISP with 100s of locations and over 1000s of network devices, it was more than just network devices that we were saw alerts for. We would get alerts if a door opened, temperature alarms, power alarms, backup generator alarms, even if the fuel was running low in one of the fuel tanks for the generators, we would see a low fuel alarm come up. This gives you an example of the visibility you can have in to your network.

    There is a large variety of different tools that do network monitoring such as SolarWinds, PRTG, and Zabbix, there are also other platforms that have their own built-in monitoring such as SD-WAN & Cisco Catalyst Center. For my own home lab, I use both PRTG and Zabbix however PRTG only allows 100 sensors for free and those can be taken up fast depending on what you’re monitoring. I’ll do a breakdown comparing PRTG vs Zabbix in another post.  

    The many technologies for network monitoring in my experience are SNMP, Netflow, Syslog and Cisco’s IP SLA. Each has their own purpose.

    SNMP

    SNMP – Simple Network Management Protocol – is one of the main protocols/technologies when it comes to network monitoring. It can be used to monitor routers, switches, firewalls, servers, and printers. SNMP operates with 3 major components. The SNMP Manager or NMS (Network manager software), SNMP Agent the software that runs on the network device, and the MIB (Management Information Base) which is a structured database of objects that can be queried via SNMP. Each object is identified by an OID (Object Identifier). There are 2 different versions of SNMP.

    There are 2 different versions of SNMP. SNMP Version 2 and SNMP Version 3.

    SNMPv2 sends messages in clear text over the network. SNMPV3 offers Authentication and Encryption on messages sent over the network. 

    SNMP uses GET and SET. It uses GET requests to pull information off the device such as hostname, system up time and other information and SET request to modify or change the configuration, such as change the hostname or even shutdown an interface, this only works if the write command is configured for the SNMP community string or account if SNMP version 3 is used.  Most cases SNMP is set to read only.

    Traps & informs are pushed from the agent (router, switch) to the NMS (Network manager software) when a notification happens such as an interface going down

    SNMP uses 2 standard ports for sending information to the NMS agent receives requests on Port 161, and the manager receives notifications on Port 162

    Netflow

    Netflow – is a protocol that was developed by Cisco but has been adapted by other networking companies I think Juniper has their own version called J-Flow. Netflow does Traffic & Bandwidth Monitoring helps with troubleshooting by seeing which user/application are consuming bandwidth it also provides Security & Anomaly Detection by Identifies abnormal traffic patterns such as unusual large data transfers and spikes in network traffic.

    Netflow is made up of 3 parts

    Exporter: This is a router or switch that collects packets in to flows and sends data records.

    Collector:  This is the server that receives the data from the exported flow data.

    Analyzer: Is the software that collects the data and makes it into a clear view for the network team to view all network activities. PRTG easy to setup build in analyzer.

    Netflow collects the following key information

    • Source and destination IP
    • Source and destination Ports
    • Layer 3 protocol types
    • Type of services
    • Input / output interfaces.

    Using NetFlow summarizing traffic into flows provides a deep visibility into how networks are used without the overhead of packet capture or spend time configuring port mirroring and with packet capturing having to filter through the PCAP file if you’re on a large-scale network with a lot of traffic.

    Syslog

    syslog – is a protocol is used to collect system event log messages and having a syslog server to have all your log events from network devices and servers in stored in one location allows for troubleshooting issues and running audits on your network to also see any issues before they cause major problems such as a link getting congested or a CPU or RAM that is running high, which also could be sent via SNMP. Syslog server is important because some network devices such as some cisco devices store their log files in RAM and when the devices is rebooted the log files are erased making troubleshooting an issue more difficult. you’re able to pick what type of messages gets sent to the sys log server such between the Severity Level scale of 0 (Emergency) to 7 (debug).

    Cisco IP SLA

    Cisco IP SLA can be used to monitor network performance and track connectivity over the network. IP SLA allows monitor network performance in real time, instead of passive monitoring that the other protocols I’ve mentioned. IP SLA generates its own traffic to measure metrics such as latency, jitter, packet loss, and availability. Juniper has their own version of IP SLA called Real-time performance monitoring (RPM) I have not touched that with my few years working with Juniper hardware but that would be a good idea to spin it up in a lab one of these days.

    IP SLAs can be configured on devices such as router or switches to send test data to a destination end point. This data can be used to simulate real network traffic such as ICMP response time, UDP, TCP, HTHTP, DNS and VOIP streams, which makes it very helpful with troubleshooting jitter on voice and video.

    There are also other issues of IP SLA in the cisco can be used for such as monitoring a link and switching over to a back up link if it notices the primary link error threshold or jitter threshold are not met and switch over to a back up link.

    Running a tier with SNMP, Netflow and syslog in network monitoring system is a great way to have overall visibility of your entire network and to have the most accurate network monitoring allowing you to quickly identify and troubleshoot your network problems and even flag them before they become a bigger issue down the road. There are other ways of network monitoring and other software, I’ve going from what I’ve seen and what I’ve used myself while working in networking. I do plan to do a post on each of these technologies and break them down one by one and show how they can be configured and show some examples of them running on my home lab.

    +

    +

    +

    +

    +

    +

    + , ,
    + , , , , , , , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • EIGRP – Part 2

    +

    +

    +

    +

    +

    +

    I’ve already done one post regarding EIGRP, but I said I was going to do a second post going over a few more advanced topics regarding EIGRP routing protocol. Check out my previous EIGRP post by clicking here.

    EIGRP uses Hello packets to check that their neighbors are still active, these packets are sent out default EIGRP hello timer is 5 seconds, slower interfaces it uses 60 seconds. EIGRP uses a told time to tell the neighbor how long to wait without receiving EGIRP packets back before it declares the neighbor down, by default 3 x hello packet are send, if the router receives EIGRP packets the timer is reset. If it fails to receive any EIGRP packets the neighbor is declared down for a Ethernet interface it would take 15 seconds (3x5s) to declare the neighbor is down or 180 seconds (3x60s) on a slower interface. You can adjust these timers per interface but applying the configuration on the interface itself with the following:

    R1(config-if)#ip hello-interval eigrp 100 3 – 100 is the AS of EIGRP / EIGRP hello interval to 3 seconds.

    R1(config-if)#ip hold-time eigrp 100 10 – 100 is the AS of the EIGRP / 10 is holding timer.

    To verify these timers with the following command.

    R1# show ip eigro interface detail gi0/1 | include Hello | hold

    EIGRP Route Summarization is used to reduce the size of your routing table when you have a large number of routes you can summary them with EIGRP. This creates smaller routing tables, less routing updates, and improves stability. Older routers ISO have route summarization on by default, newer routers ISO have them turned off by default you can enable automatic summarization with the command auto-summary or no auto-summary, I would advise against replying on auto summary.  Example of summarizing a route when you have the following networks:

    10.0.0.0/24
    10.0.1.0/24
    10.0.2.0/24
    10.0.3.0/24

    Will summarize to 10.0.0.0/22

    To find this you convert the last 3 octet into binary and see which match in this example converting the 3rd octet to binary to get the following

    0000 0000
    0000 0001
    0000 0010
    0000 0011

    Common bits are 000 000
    To find the subnet mask you calculate the following
    1st octet (10): 8 bits
    Second octet (0): 8 bits
    Common bits in third octet: 6 bits
    Subnet mask – 8+8+6 = 22

    This will allow the following networks to be summarized 10.0.0.0 – 10.0.3.255

    You would apply the route summary to the EIGRP interface

    R1(config-if)# ip summary eigrp 100 10.0.0.0 255.255.252.0

    EIGRP Stub routers limit their participation in EIGRP which benefits the networks making more efficient, scalable and stable. It works well in a hub and spoke design. EGIRP stub routers do not advertise routes learned from other routers. Stub Routers oonly advertises specific locally relevant routes. EIGRP Stub reduces EGIRP queries from flooding the network during route failures and prevents networks from slow convergence or stuck in active state as well as preventing routing loops.

    EGIRP stube routers are configured with the following options, this chart is from a cisco router.

    Stub TypeAdvertises
    connectedDo advertise connected routes
    leak-mapAllow dynamic prefixes based on the leak-map
    receive-onlySet receive only neighbor
    redistributedDo advertise redistributed routes
    staticDo advertise static routes
    summaryDo advertise summary routes

    You can configure EGIRP stub routers with the following commands

    R2(config)#router eigrp 100

    R2(config-router)#eigrp stub connected | Summary | static.

    EIGRP Authentication

    EIGRP Authentication is configured to ensure that only authorized routers are able to form neighbor adjacency. EIGRP password is included in the EIGRP packets, and the neighbor router decrypts the hash, if the password does not match the packets are discard and a neighbor adjacency does not form. EIGRP encrypts the password by using MD5 authentication and the keychain function. Keychain is used for authentication between devices, it’s like a name list for shared secret keys that are used for routing protocols to verify routing updates. You would configure EIGRP Authentication with the following commands:

    R2#config t
    R2(config)#key chain KEYCHAINNAME
    R2(config-keychain)# key 2
    R2(config-keychain-key)# Key-string PASSWORD

    R2(config-keychain-key)#int gi0/0
    R2(config-if)#ip authentication mode eigrp 100 md5
    R2(config-if)#ip authentication key-chain eigrp 100 KEYCHAINNAME

    If you’re using named EIGRP you would do the following commands

    R1#config t
    R1(config)#key chain KEYCHAINNAME
    R1(config-keychain)# key 2
    R1(config-keychain-key)# Key-string PASSWORD

    R1(config)#Router eigrp EVANS-NETWORKS
    R1(config-router)#address-family ipv4 unicast autonmous-system 100
    R1(config-router-af)#af interface default
    R1(config-router-af-interface)#authentication mode md5
    R1(config-router-af-interface)#authentication key-chain KEYCHAINNAME

    You should see the neighbour adjacency come up if configured correctly.

    to troubleshoot your keychain, you can do the following commands

    R1#show key chain

    R2#show ip eigrp interface details

    That’s the end of my post for EIGRP more advanced topics, let me know if you have any questions or would like me to cover something else. I do have plans in the future to do a post with route redistribution with EIGRP and OSPF. Make sure you check out my other EIGRP post here.

    +

    +

    +

    +

    +

    +

    + ,
    + , , , , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • OSPF

    +

    +

    +

    +

    +

    +

    OSPF stands for Open Shortest Path First it is an interior gateway routing protocol. OSPF is a link-state routing protocol. OSPF is my go to protocol that I like working with, OSPF is not a vendor specific protocol, a number of vendors also run OSPF on their networking devices, I’ve personally used OSPF on Juniper and Fortigate. OSPF is a link state protocol that stores the full network topology, OSPF uses autonomous system like EIGRP but also uses areas. There are 2 different versions of OSPF OSPFv2 that supports IPv4 and OSPFv3 that supports IPv6, I’m only going to be covering OSPF IPv4.

    OSPF is a very powerful routing protocol with the ability scale using areas. OSFP areas are used in a hierarchical design where all areas must connect back to area 0 the backbone area. A reason for areas was for older Cisco routers limitations with high CPU loads which would cause links to flap it was recommend for a maximum of 40 to 50 routers per area. Now of days there is no hard limit to the number of routers an OSPF area can have but it’s still a good idea to keep the number on the lower ends for troubleshooting, keeping an OSPF hierarchical design.

    In order for OSPF routers to establish neighbor’s adjacency it uses hello packets from the OSPF neighbor interfaces. Routers much have the same area ID, subnet, hello and dead timers as well as the stub area flag. OSPF sends link-state advertisements (LSAs) to neighbor routers. LSAs are stored in local database called the link-state database (LSDB). Routers running OSPF will flood LSAs throughout the network, routers running OSPF will all keep an identical copy of the LSDB within the same area, which provides an overall topology of the network. There are different types of LSAs that I’ll be going over in this post.

    The process of neighbor adjacency forming is sent over multicast-based updates using addresses 244.0.0.5 and 244.0.0.6.

    The neighboring most common states are the following:

    • Down: no information received from neighbors.
    • Init: Hello is received, but bidirectional communication is not confirmed yet.
    • 2-way: bidirectional communication is established
    • ExStart: Database synchronization initialization
    • Exchange: Database packets are exchanged
    • Loading: request missing /more recent LSAs
    • Full: Full adjacencies are formed – LSDBs are synchronized

    Once routers become neighbors and they are on muilit-access networks such as ethernet, a election process takes place and 1 router will become the Designated Router (DR) and Backup Designated Router (BDR) are elected to reduce routing update traffic.

    OSPF will have different types of Link-state advertisements such as

    Type 1: Router LSA – Links of routers within an area
    Type 2: Network LSA – Generated by the DR for mulit-access networks
    Type 3: Summary LSA – Advertises routes between areas
    Type 5: External LSA – Advertises routes redistributed from other protocols.

    Once routers become neighbors and databases are synchronized, they need to determine which path is the best to take. OSPF does this by each router running the Dijkstra’s Shortest Path First algorithm to calculate the shortest path to each known network. The result of the SPF calculation will put the best route into the routing table of that local router.

    OSPF uses cost as it’s metric by default, the cost is calculated with Cost = Reference Bandwidth / Interface Bandwidth. Most devices the default reference bandwidth is 100Mbps which causes high speed links to appear equal such as a 100mpb link would be the equal to 1Gbps link which is why the reference bandwidth is manually adjusted to reflect the current network link speeds.

    OSPF Configuration

    For this configuration I am going to be using multiple areas I’m going to configure area 0 will always be the backbone all routers from one area need to connect to area 0 via area border routers (ABR), in this case R2 and R3 will be the area border routers (ABR). The ABR is responsible for the LSDB for each area. Like my EIGRP configuration I’m going to be doing my OSPF configuration 3 different ways, one is the normal OSPF configuration, the next one configuration OSPF on the interfaces and the last way will be using a wild card mask for all networks.

    Configuration for Router 1 configure using the networks


    R1(config)#router ospf 1
    R1(config-router)#router id 1.1.1.1
    R1(config-router)#network 10.1.1.0 0.0.0.3 area 0
    R1(config-router)#network 172.16.1.0 0.0.0.3 area 0

    Configuration for Router 2 configure using the networks, notice that the 192.168.1.0 is configured for area 1 while network 10.1.1.0 is configured for area 0 (backbone area)


    R2(config)#router ospf 1
    R2(config-router)# router-id 2.2.2.2
    R2(config-router)#network 10.1.1.0 0.0.0.3 area 0
    R2(config-router)# network 192.168.1.0 0.0.0.3 area 1

    Configuration for Router 3 configure using the interfaces that I want OSPF to be enabled on. You still need to enable OSPF and configure the AS with router ospf 1 command and configured the router id than you can configure OSPF on the interfaces. Also remember to configure the correct area for each interface you are enabling OSPF on. In this case interface gi0/1 will be in area 0 and interface gi0/0 will be in area 2.


    R3(config)#router ospf 1
    R3(config-router)# router-id 3.3.3.3
    R3(config-if)#int gi0/1
    R3(config-if)#ip ospf 1 area 0
    R3(config)#int gi0/0
    R3(config-if)#ip ospf 1 area 2

    For R4 and R5 configurations I’m using a catch all networks with a wild card mask to match all, this configuration I won’t recommend using out side of a lab or testing environment because you don’t want to have everything advertised on your network with OSPF but it is away it can be configured so I did want to show that it does work. If you’ve seen this configure in a real world network environment let me know.

    R4 – Config

    R4(config)#router ospf 1
    R4(config-router)# router-id 4.4.4.4
    R4(config-router)# network 0.0.0.0 255.255.255.255 area 1

    R5 – Config


    R5(config)#router ospf 1
    R5(config-router)#router-id 5.5.5.5
    R5(config-router)#network 0.0.0.0 255.255.255.255 area 2

    OPSF verifying and troubleshooting commands.

    show ip route ospf – shows the routing table but filters the routes learned by only OSPF

    show ip ospf neighbor – shows the OSPF neighbors, shows the Neighbor IDs the state Address of the interface and the interface of the neighbors.

    show ip protocols – shows what protocol is running, shows the areas, shows the router ID and the networks that are being advertised and the AD for OSPF. This command helps troubleshoot all routing protocols

    show ip ospf database – will show the LSDB on the Router one it will also show the different LSAs I’ll go over this command more on my next post about OSPF and the different sub commands to use with it.

    OSPF is very complex networking protocol, I’m going to have another post for OSPF that will go over Different types of OSPF network types such as point-to-point and broadcast, the different types of LSA in more details, and OSPF stubby areas and virtual links.  

    +

    +

    +

    +

    +

    +

    + ,
    + , , , , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • EIGRP

    +

    +

    +

    +

    +

    +

    EIGRP stands for Enhanced Interior Gateway Protocol, it’s a cisco proprietary protocol that is developed by cisco, however now of days it’s been open up to other platforms. I’m only going to be over IPv4 at this time.

    EIGRP exchange routing information to form neighbours to dynamically learn and maintain paths within the network. EIGRP discovers and maintains neighbours by sending out multicast hello packets to the address 224.0.0.10 every 5 seconds.  Once neighbour relations are formed routing information is shared and EIGRP calculate the best path primary and secondary path for quick fail over recovery. EGIRP neighbours only share information with the same AS Autonomous System number, Matching K-vaules (metric Weights), subnet and authentication settings if authentication is configured.

    EIGRP uses DUAL (Diffusing Update Algorithm) which calculates the shortest path and prevents loops. DUAL uses a feasible distance (FD) the lowest metric to a destination and reported distance (RD) the metric advertised by the neighbour. A success is the next hop router with the lowest FD while a feasible successor is the neighbor whose RD is less than the current FD. DUAL prevent loops by not sending updates out the interface that receives them.

    EIGRP maintains a number of different tables to maintain routing information.

    Neighbor Table – All directly connected routers that have formed a neighbour relationship

    Topology Table – All possible routes learned from the neighbors to calculate the Successor and Feasible successor

    Routing Table – Best routes by DUAL in the routing table, only successors will appear in the routing table.

    EIGRP Packet types

    Hello – used to establish and maintain neighbor relations
    Update – sends routing information
    Query – used when a router goes down and no feasible backup path
    Reply – sends in response to a query
    ACK – acknowledges certain EIGRP Packets.

    EGIRP calculates its metrics based off a sophisticated composite of metrics such as bandwidth, delay, reliability, load and MTU however the default metric only uses bandwidth and delay.

    Cisco has an elaborate formulate to calculate its Metrics as which is the following formula.

    Metric = [K1 * bandwidth + (K2 * bandwidth) / (256 – load) + K3 * delay] * [K5 / (reliability + K4)] * 256

    Default K-values are K1=1, K2=0, K3=1, K4=0, K5=0, simplifying to bandwidth + delay. Bandwidth is inversely scaled: (10^7 / minimum bandwidth in kbps) * 256. For more information how this is calculated please cisco Cisco’s explanation I’m not the best at explaining the calculations of EIGRP to make enough sense.

    Configuring EIGRP

    To configure EIGRP you are able there are a few different approaches you can take you can configure it with an autonomous system number, or you can do named EIGRP and matching all networks using a wild card mask.  Above is the topology I’m going to be using for the configuration examples.

    EIGRP with autonomous system configuration

    R2(config)#router eigrp 100
    R2(config-router)#router-id 1.1.1.1
    R2(config-router)#network 172.16.2.0 255.255.255.252
    R2(config-router)#network 172.16.3.0 255.255.255.252

    Named EIGRP configuration


    R1(config)#router eigrp EVANS-NETWORKS
    R1(config-router)#address-family ipv4 unicast autonomous-system 100
    R1(config-router-af)#eigrp router-id 1.1.1.1
    R1(config-router-af)#network 172.16.2.0 255.255.255.252
    R1(config-router-af)#network 172.16.3.0 255.255.255.252

    To configure router 3, I’m going to use a wildcard mask that will include all networks that are configured on router3

    R3(config)#router eigrp 100
    R3(config-router)#router-id 3.3.3.3
    R3(config-router)#network 0.0.0.0 255.255.255.255

    You can check your configuration by the log messages if you have them turned on to see that neighbours have been formed you can also check by issuing the show ip route command

    There are some cases where you do not want EIGRP advised you can do that by using the using the passive interface command which do not send out EIGRP hellos and prevents EIGRP from forming adjacencies on those interfaces. you can also configure all interfaces to be passive and than turn on the ones you want to send out hello packets & form adjacencies, which can be done by using the passive-interface default command and the interfaces you want to enable you would issue no passive-interface gi0/1.

    you add the passive interface commands under the router eigrp 100 command or if you are using named EIGRP you do it under the address family command, I’ll provide both examples

    R2(config)#router eigrp 100
    R2(config-router)#passive-interface gi0/2

    R1(config)#router eigrp EVANS-NETWORKS
    R1(config-router)#address-family ipv4 unicast autonomous-system 100
    R1(config-router-af)# af-interface gi0/0
    R1(config-router-af-interface)#passive-interface

    Troubleshooting EIGRP

    The following commands help troubleshoot EIGRP

    show ip route eigrp – shows the routing table but filters the routes learned by only EIGRP

    show ip eigrp neighbors – verify EIGRP neighbors which shows the interface the neighbour is using to send EIGRP hello packets, how long the routers have been neighbours.

    show ip eigrp interfaces – will display the interfaces that are participating in EIGRP, and which interface has a peer. Passive interfaces will not show up in this output.

    show ip protocols – shows what protocol is running and the AS, shows the router id, it will show the Internal and external AD, the networks that being routed.

    debug eigrp packets – will show a live view of receiving any hello packets from EIGRP neighbours it will also show any mismatched AS numbers, and you can see if you’re not receiving any hello packets from interfaces that you should be and determine your troubleshooting systems from there. Don’t forget to turn your debugging off once you’re done troubleshooting!

    There’s number of other features you can do with EIGRP I can do more of an advanced post about more advance topics such as authentication, summarization EIGRP Stub router, EIGRP Route manipulation.

    +

    +

    +

    +

    +

    +

    + , ,
    + , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • Cisco Unified Communications Manager & Cisco Unity Connection

    +

    +

    +

    +

    +

    +

    Cisco enterprise phone system is known as Cisco Unified Communications Manager combine with Cisco Unity Connection. I will admit I’m no expert at either of these systems, but I have worked with both Call Manager and Cisco Unity out in the real world, and I’ve had some training on them. But hey let’s learn more about them together and see what we can come up with. Cisco also has Cisco Webex calling but I’ve only had a little bit experience with that. The only other call manager I’ve been trained on but haven’t touched outside of a lab is BroadSoft which is also owned by Cisco.  I only have older versions of Call manager and Cisco Unity things might look a little dated. I would like to get new versions but maybe one day.

    Cisco call manager is in a nutshell is a PBX, it is where the IP phones, softphones, users, gateways and video endpoints are configured. Call manager handles the call routing, dial plans, voicemail integration (Cisco Unity), call admission control and media resources such as your hold music. Example if you make a call to someone and they don’t answer the phone could be configured to send the call to another number or send it to voicemail.

    Cisco Unity does voicemail, voicemail recording, voicemail features, message storage and well as IVR features such as your auto-attendant & call candlers for example if you call a company and they say for Sales press 1 for IT support press 2 and so on is configured in Cisco Unity.

    Cisco call manager and Cisco Unity can be setup and installed on-premises in a virtual environment or on a Cisco UCS server or it can be setup in a cloud as Cisco Unified Communications Manager Cloud.

    My voice Lab

    The way I have my call manager and Cisco unity lab setup is that I have both call manager and Cisco unity installed on my Dell power edge R630server that is running VMware ESXI and I have that connected to a 2960 switch my two Cisco 7940 VOIP phones are connected to which provides the POE to the phones. To access my voice map, I have USB Ethernet adapter with the same subnet as my voice lab.

    My overall goal with my lab is to setup an enterprise system where you call a number it goes to an auto-attendant and route calls to different departments, setup voicemail, call forwarding and so on my plan is to also post on here my process. I don’t think I’m going to be making big jump in building this out till after the holidays,

    +

    +

    +

    +

    +

    +

    + ,
    + , , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • Routes

    +

    +

    +

    +

    +

    +

    Routes! Routes tell network packets how to traffic across the network to get to their required destination by picking the best path. There are three different types of routes such as default routes, static routes and dynamic routes. Each one has its own pros and cons.  Routes are stored in the routing table of routers and layer 3 switches and other layer 3 devices.

    There’s a different way to routers pick the best route to send packets one way is using the administrative distance static routes and dynamic routes all have their own administrative distance is a way that Cisco makes a trustworthy decision to select the best path. Routes can also be manipulated by changing administrative distances, route maps and conditional forwarding. Here is the list the route source and the administrative distances for the most common route sources.

    Route SourceAdministrative Distances
    Connected interface0
    Static route1
    External BGP (eBGP)20
    EIGRP90
    OSPF110
    External EIGRP170
    Internal BGP (iBGP)200

    Let’s talk about each route type

    Default routes

    Default routes are mainly manually configured, if the router is not aware of the of the destination in the routing table the router sends the packets out to the default route, example of a use case would be to send all internet traffic out to one interface or to a core router.

    Default route configuration follows the following syntax

    R1(config)#ip route 0.0.0.0 0.0.0.0.0 10.1.1.1

    Or

    R1(config)#ip route 0.0.0.0 0.0.0.0 gi0/0

    The 0s tell the router to send all unmatched traffic to 10.1.1.1 or out interface gi0/0

    Default routes help simplify routing tables however default routes can hide routing issues when troubleshooting networking issues and not ideal for large networks.

    Static routes

    Static routes are manually configured by the network engineer and tell the router which path to

    send packets, they can be configured to sent to a specific network or to a specific host. Static is straight forward to configure and do not require any constant communication like dynamic routing protocols. Static routes do have a limitation when it comes to having to configure on large networks which would require a heavy workload on anyone on the networking team, there is also no automatic fail over unless configured as a floating static link. Static routes have some pros such are they are predicable admin know where traffic is going to go, static routes lower CPU usage not constantly sending updates like dynamic routing protocols, they are good for small networks or point to point links, They also provide a layer of security as they do not advise routing information with other routers on the network.

    Static route configuration follows a similar syntax is default route starting with ip route followed by the Destination | Destination mask | forwarding router’s address

    R1(config)#ip route 10.1.0.0 255.255.0.0 172.16.1.1

    Or for a host

    R1(config)#ip route 10.1.1.10 255.255.0.0 172.16.1.1

    Or

    R1(config)#ip route 10.1.0.0 255.255.0.0 gi0/0

    Dynamic routes

    There are different routing protocols for dynamic routes EIGRP, OSPF and BGP just to name the most common ones, there is also internal and external routing protocols, both EGIRP and OSPF are internal routing protocols and BGP is an external routing protocol. EIGRP, OSPF and BGP all have their different ways of determining how to choose the best path and how they calculate the best path to send packets to reach its destination.

    Routing protocols are configured by the network team once configured they automatically discover, share and update routes between routers. Dynamic routing protocol work really well for large networks. Dynamic routing protocols provide fault tolerance if a link fails re routes traffic with minimum down time, they also reduce workload for the network team not having to manually added each route one by one. The cons of dynamic routing protocols use more resources on the router such as RAM, CPU and bandwidth updating, maintaining routing tables. If not configured properly there is a chance of creating a routing loop and security concerns allowing someone to intercept routing updates.

    There are different ways to configure EIGRP, OSPF and BGP, there is also way to get these protocols to talk to each other using route redistribution. I’ll do a deep dive in to each of these protocols going forward and how to configure them and different ways of troubleshooting each protocol.

    Troubleshooting static routes and default routes

    here are some of the commands that I would use, along with the normal troubleshooting commands such as ping, trace route, checking interface status, and interface configuration, make sure the interface is not shutdown and has the correct IP address.

    R1#show ip route – show the routing table and see your static routes and the default route that is configured

    R1#show run | ip route – will show the configuration of the static routes and default routes that are configured on the router.

    R1#show run | ip route 0.0.0.0 – will bring up the configuration of the default route.

    +

    +

    +

    +

    +

    +

    + ,
    + , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • Network Topology Architectures

    +

    +

    +

    +

    +

    +

    Network Topology Architectures has a few different designs such as three-tier, two-tier / collapsed core, spine-leaf mainly for data centers, small office/home office (SOHO), and on-premises/cloud. One of the reasons these make complicated large networks less completed and give them more of a hierarchy design.

    Three-Tier Architecture

    Three-Teir Architecture design works well for large enterprise networks as well as ISP environments,

    They help make complex networks easier to manage, allow easier scalability making adding devices/upgrading easier. Also, more reliable with more layers of redundancy and better performance. The draw backs are cost, and it does make the network more complex. The Three-Teir consist of 3 layers the core, distribution and access layers

    Core Layer – the core layer is the backbone of the network, connects to the ISP, connects to other branch offices. Core Layer would be configured with Routing Standby protocols. The Core layer has multiple connection to the distribution layer This is where high end devices would operate.

    Distribution layer – This layer provides communication between the access layer and the core layer. This layer has redundancy build in for the access layer switches and to the core layer. The distribution layer applies access-lists and QoS policies.

    Access Layer – The access layer is where all the users and end devices such as computers, phones, printers, servers, access points, etc., are connect to the network. This layer allows users to share data and resources within internal the network through the distribution layer. Network segmentation happens at the access layer with VLANs.

    Two-Tier

    The two-tier design also known as a collapsed core, the core and the distribution layers are combined. This design good for smaller networks and is more cost efficient with eliminating the core layer. The Core and distribution layer functions as both the core and distribution layers in the two-tier design. Two-tier design still allowed scalability and easier expansion as well as redundancy.

    Spine-Leaf Architecture

    Spine-Leaf Architecture – is modern design that is for data centers, AI, and cloud environments, this is for very high bandwidth and high performance, with little hop count between devices. This design creates a full mesh allowing for easy scalability allowing to add more spine and leaf switches if as needed.  This design is more costly and is normally managed by Cisco DNA center now called Cisco Catalyst Center using an overlay and underlay network. You will see mostly Cisco nexus devices at the spine and leaf design.

    small office/home office is a flat network sometimes just the internet modem/router that your ISP provides, in other cases with a firewall/router and switch and a device that provides wireless. SO/HO have a small number of end users and devices such as computers, laptops printers. SO/HO are not as costly and can be plug and play and does not require much administration.

    on-premises is when all networking, servers, storage, and software is located locally on site. Everything falls on the local IT team to manage. Start up costs are higher such as space for networking devices, power, cooling and maintenance, physical security is required as well as Disaster recovery. This is used a lot for sensitive data such as healthcare or financial.

    Cloud is hosted at places such as AWS or Azure and can be based on a pay as you need allowing to spin up and turn down different services during high traffic times if required. Disaster recovery is done by the cloud provider, also security relies on the provider as well leaving a chance for some risk.

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

  • Spanning tree protocol

    +

    +

    +

    +

    +

    +

    With the scaling of today’s networks switches end up connecting to each other, sometimes a switch is connected to a switch to for more access ports in a growing office or connected for redundancy between switches, if a link fails traffic can go through one of the other links that the switch is connected to, however could create a huge problem know as a switching loop. If you have 3 switches connected into each other link in my diagram, SW1 would send a broadcast to switch SW2 and send same broadcast in to SW3 and would send it back in to SW1 and the loop would start. Switch CPU would go to 100%, connectivity will be very slow or drop and there will be endless broadcast frames going out the interfaces, bandwidth gets fully consumed. We are talking about full network apocalypse!! To stop this switching loop from occurring Spanning Tree Protocol (STP) is used. STP is an older protocol but there are newer versions that I will cover during the post, I just wanted to go over why we needed STP in the first place, STP is an old protocol, I wanted to go over why it needed and how it is used today, I will go over the different modes in this post.

    Spanning Tree Protocol creates a loop free network STP is defined as IEEE 802.1D. STP blocks/disables ports to stop the loop from happening, only allowing one to be active along the network path between 2 switches. If there is a failure on a link between the switches STP will auto reconfigure the topology and active ports that were blocked and restore connectivity.

    Spanning Tree Protocol goes through an election process to select a Root bridge which exchanges bridge protocol data units (BPDUs) which messages the switches to determine which switch ports should be blocked and which should forward traffic. The root bridge is elected based on the bridge IDs, the bridge with the lowest BID is elected as the root bridge. If there is a tie with the BIDs the switch with the lowest MAC address with be elected as the root bridge.  The non root switches will determine which port is the root port, designated port and the blocked port.

    Root port – The lowest cumulative path cost to the root bridge only non root switches have a root port.

    Designated Port – Each network the port with the lowest cost to the root becomes the designated port the switch wit the s port forwards traffic to the root.

    Blocked port – All other ports that would cause a switching loop are blocked they receive BPDUs updates but do not forward them.

    During STP convergence ports going through the following states:
    Blocking – does not forward data, does not learn MAC Addresses
    Listening – Does not forward data, does not learn MAC Addresses
    Learning – does not forward data, does learn MAC Addresses
    Forwarding – Does forward data, does learn MAC Addresses
    Disabled – does not forward data, does not learn MAC addresses

    There are restraints with spanning tree protocol such as slow convergence time taking up to 50 seconds which is not acceptable for voice or video, single root bridge all traffic flows through the root bridge could cause network bottlenecks and only one path per VLAN. Modern switches don’t support STP and see it as legacy even in my lab with my old Cisco 2960 does not have the older STP version. Cisco switches come the default of PVST+ or RPVST.

    To deal with the above issues with STP and with changing technology there are different versions of STP such as the following

    • PVST+ – Cisco Proprietary – Per-VLAN Spanning Tree, load balancing across VLANs
    • RSTP – convergence in 3–6 seconds
    • RPVST – Cisco Proprietary – Combination of the rapid convergence of RSTP and the per-VLAN control of PVST+
    • MSTP – Multiple STP instances mapped to VLAN groups

    Configuring Spanning-Tree Protocol

    Configuring Spanning-tree is done in the global configuration mode in the switch using the following commands depending on which mode you want to use.

    SW1(config)#spanning-tree mode (mst | pvst | rapid-pvst)

    When configuring spanning-tree it’s a good idea to configure BPDU Guard on access ports to protect against rouge devices, if an interface with BPDU Guard enabled will go into err-disable if it receives any BPDUs.

    BPDU Guard is configured under the interface mode using the following command.

    SW1(config-if)#spanning-tree bpduguard enable

    Another good idea when configuring spanning tree is to configure spanning tree port fast which allows interfaces to skip the learning and listening stages of STP this is used to stop end devices waiting for the STP stages and allow for DHCP processes from timing out and VOIP phones to register quickly with the voice gateway/ Cisco Unified Communications Manager. To configure port fast it is also done under interface mode with the following command.

    SW1(config-if)#spanning-tree portfast edge


    Configuring Spanning-Tree Protocol MST

    To configure Configuring Spanning-Tree Protocol MST Multiple Spanning Tree, each you VLAN are configured as it’s own instance you also configuration revision number that allows for easier updates when making changes to your STP MST configuration, to show how to configure this I’ll be using the following topology with 4 VLANs configured.

    The example I use is in my above topology with the following commands on both SW1 & SW2.

    SW1(config)#spanning-tree mode mst
    SW1(config)#spanning-tree mode mst configuration
    SW1(config-mst)#name MST-LAB
    SW1(config-mst)#revision 1
    SW1(config-mst)#instance 1 vlan 90
    SW1(config-mst)#instance 2 vlan 100
    SW1(config-mst)#instance 3 vlan 110
    SW1(config-mst)#instance 4 vlan 120

    Verify Spanning-tree MST configuration with the command show spanning-tree mst or Show spanning-tree mst 2

    You can see the different MST instances are broken up and witch they belong to and you can  see how MST0 by default has all the VLANs that have not been assigned to it.  

    Troubleshooting Spanning tree Protocol Commands

    show spanning-tree summary

    show spanning-tree detail

    show spanning-tree root

    show spanning-tree interface

    show spanning-tree vlan

    Spanning tree is a great protocol, in my years of networking I haven’t really had to touch it or configure it the most I’ve the only thing I’ve had to do was for troubleshooting is remove the spanning-tree bpduguard command off an interface and add spanning-tree portfast edge to an interface I’m sure everyone has different experiences I’m just speaking for myself.

    +

    +

    +

    +

    +

    +

    + ,
    + , , ,

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +

    +