- •Warning and Disclaimer
- •Feedback Information
- •Trademark Acknowledgments
- •About the Author
- •About the Technical Reviewers
- •Dedication
- •Acknowledgments
- •Contents at a Glance
- •Contents
- •Icons Used in This Book
- •Command Syntax Conventions
- •Cisco’s Motivation: Certifying Partners
- •Format of the CCNA Exams
- •What’s on the CCNA Exams
- •ICND Exam Topics
- •Cross-Reference Between Exam Topics and Book Parts
- •CCNA Exam Topics
- •INTRO and ICND Course Outlines
- •Objectives and Methods
- •Book Features
- •How This Book Is Organized
- •Part I: LAN Switching
- •Part II: TCP/IP
- •Part III: Wide-Area Networks
- •Part IV: Network Security
- •Part V: Final Preparation
- •Part VI: Appendixes
- •How to Use These Books to Prepare for the CCNA Exam
- •For More Information
- •Part I: LAN Switching
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Brief Review of LAN Switching
- •The Forward-Versus-Filter Decision
- •How Switches Learn MAC Addresses
- •Forwarding Unknown Unicasts and Broadcasts
- •LAN Switch Logic Summary
- •Basic Switch Operation
- •Foundation Summary
- •Spanning Tree Protocol
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Spanning Tree Protocol
- •What IEEE 802.1d Spanning Tree Does
- •How Spanning Tree Works
- •Electing the Root and Discovering Root Ports and Designated Ports
- •Reacting to Changes in the Network
- •Spanning Tree Protocol Summary
- •Optional STP Features
- •EtherChannel
- •PortFast
- •Rapid Spanning Tree (IEEE 802.1w)
- •RSTP Link and Edge Types
- •RSTP Port States
- •RSTP Port Roles
- •RSTP Convergence
- •Edge-Type Behavior and PortFast
- •Link-Type Shared
- •Link-Type Point-to-Point
- •An Example of Speedy RSTP Convergence
- •Basic STP show Commands
- •Changing STP Port Costs and Bridge Priority
- •Foundation Summary
- •Foundation Summary
- •Virtual LANs and Trunking
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Review of Virtual LAN Concepts
- •Trunking with ISL and 802.1Q
- •ISL and 802.1Q Compared
- •VLAN Trunking Protocol (VTP)
- •How VTP Works
- •VTP Pruning
- •Foundation Summary
- •Part II: TCP/IP
- •IP Addressing and Subnetting
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •IP Addressing Review
- •IP Subnetting
- •Analyzing and Interpreting IP Addresses and Subnets
- •Math Operations Used to Answer Subnetting Questions
- •Converting IP Addresses from Decimal to Binary and Back Again
- •The Boolean AND Operation
- •How Many Hosts and How Many Subnets?
- •What Is the Subnet Number, and What Are the IP Addresses in the Subnet?
- •Finding the Subnet Number
- •Finding the Subnet Broadcast Address
- •Finding the Range of Valid IP Addresses in a Subnet
- •Finding the Answers Without Using Binary
- •Easier Math with Easy Masks
- •Which Subnet Masks Meet the Stated Design Requirements?
- •What Are the Other Subnet Numbers?
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Extended ping Command
- •Distance Vector Concepts
- •Distance Vector Loop-Avoidance Features
- •Route Poisoning
- •Split Horizon
- •Split Horizon with Poison Reverse
- •Hold-Down Timer
- •Triggered (Flash) Updates
- •RIP and IGRP
- •IGRP Metrics
- •Examination of RIP and IGRP debug and show Commands
- •Issues When Multiple Routes to the Same Subnet Exist
- •Administrative Distance
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Link-State Routing Protocol and OSPF Concepts
- •Steady-State Operation
- •Loop Avoidance
- •Scaling OSPF Through Hierarchical Design
- •OSPF Areas
- •Stub Areas
- •Summary: Comparing Link-State and OSPF to Distance Vector Protocols
- •Balanced Hybrid Routing Protocol and EIGRP Concepts
- •EIGRP Loop Avoidance
- •EIGRP Summary
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Route Summarization and Variable-Length Subnet Masks
- •Route Summarization Concepts
- •VLSM
- •Route Summarization Strategies
- •Sample “Best” Summary on Seville
- •Sample “Best” Summary on Yosemite
- •Classless Routing Protocols and Classless Routing
- •Classless and Classful Routing Protocols
- •Autosummarization
- •Classful and Classless Routing
- •Default Routes
- •Classless Routing
- •Foundation Summary
- •Advanced TCP/IP Topics
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Scaling the IP Address Space for the Internet
- •CIDR
- •Private Addressing
- •Network Address Translation
- •Static NAT
- •Dynamic NAT
- •Overloading NAT with Port Address Translation (PAT)
- •Translating Overlapping Addresses
- •Miscellaneous TCP/IP Topics
- •Internet Control Message Protocol (ICMP)
- •ICMP Echo Request and Echo Reply
- •Destination Unreachable ICMP Message
- •Time Exceeded ICMP Message
- •Redirect ICMP Message
- •Secondary IP Addressing
- •FTP and TFTP
- •TFTP
- •MTU and Fragmentation
- •Foundation Summary
- •Part III: Wide-Area Networks
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Review of WAN Basics
- •Physical Components of Point-to-Point Leased Lines
- •Data-Link Protocols for Point-to-Point Leased Lines
- •HDLC and PPP Compared
- •Looped Link Detection
- •Enhanced Error Detection
- •Authentication Over WAN Links
- •PAP and CHAP Authentication
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •ISDN Protocols and Design
- •Typical Uses of ISDN
- •ISDN Channels
- •ISDN Protocols
- •ISDN BRI Function Groups and Reference Points
- •ISDN PRI Function Groups and Reference Points
- •BRI and PRI Encoding and Framing
- •PRI Encoding
- •PRI Framing
- •BRI Framing and Encoding
- •DDR Step 1: Routing Packets Out the Interface to Be Dialed
- •DDR Step 2: Determining the Subset of the Packets That Trigger the Dialing Process
- •DDR Step 3: Dialing (Signaling)
- •DDR Step 4: Determining When the Connection Is Terminated
- •ISDN and DDR show and debug Commands
- •Multilink PPP
- •Foundation Summary
- •Frame Relay
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Frame Relay Protocols
- •Frame Relay Standards
- •Virtual Circuits
- •LMI and Encapsulation Types
- •DLCI Addressing Details
- •Network Layer Concerns with Frame Relay
- •Layer 3 Addressing with Frame Relay
- •Frame Relay Layer 3 Addressing: One Subnet Containing All Frame Relay DTEs
- •Frame Relay Layer 3 Addressing: One Subnet Per VC
- •Frame Relay Layer 3 Addressing: Hybrid Approach
- •Broadcast Handling
- •Frame Relay Service Interworking
- •A Fully-Meshed Network with One IP Subnet
- •Frame Relay Address Mapping
- •A Partially-Meshed Network with One IP Subnet Per VC
- •A Partially-Meshed Network with Some Fully-Meshed Parts
- •Foundation Summary
- •Part IV: Network Security
- •IP Access Control List Security
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Standard IP Access Control Lists
- •IP Standard ACL Concepts
- •Wildcard Masks
- •Standard IP ACL: Example 2
- •Extended IP Access Control Lists
- •Extended IP ACL Concepts
- •Extended IP Access Lists: Example 1
- •Extended IP Access Lists: Example 2
- •Miscellaneous ACL Topics
- •Named IP Access Lists
- •Controlling Telnet Access with ACLs
- •ACL Implementation Considerations
- •Foundation Summary
- •Part V: Final Preparation
- •Final Preparation
- •Suggestions for Final Preparation
- •Preparing for the Exam Experience
- •Final Lab Scenarios
- •Scenario 1
- •Scenario 1, Part A: Planning
- •Solutions to Scenario 1, Part A: Planning
- •Scenario 2
- •Scenario 2, Part A: Planning
- •Solutions to Scenario 2, Part A: Planning
- •Part VI: Appendixes
- •Glossary
- •Answers to the “Do I Know This Already?” Quizzes and Q&A Questions
- •Chapter 1
- •“Do I Know This Already?” Quiz
- •Chapter 2
- •“Do I Know This Already?” Quiz
- •Chapter 3
- •“Do I Know This Already?” Quiz
- •Chapter 4
- •“Do I Know This Already?” Quiz
- •Chapter 5
- •“Do I Know This Already?” Quiz
- •Chapter 6
- •“Do I Know This Already?” Quiz
- •Chapter 7
- •“Do I Know This Already?” Quiz
- •Chapter 8
- •“Do I Know This Already?” Quiz
- •Chapter 9
- •“Do I Know This Already?” Quiz
- •Chapter 10
- •“Do I Know This Already?” Quiz
- •Chapter 11
- •“Do I Know This Already?” Quiz
- •Chapter 12
- •“Do I Know This Already?” Quiz
- •Using the Simulation Software for the Hands-on Exercises
- •Accessing NetSim from the CD
- •Hands-on Exercises Available with NetSim
- •Scenarios
- •Labs
- •Listing of the Hands-on Exercises
- •How You Should Proceed with NetSim
- •Considerations When Using NetSim
- •Routing Protocol Overview
- •Comparing and Contrasting IP Routing Protocols
- •Routing Through the Internet with the Border Gateway Protocol
- •RIP Version 2
- •The Integrated IS-IS Link State Routing Protocol
- •Summary of Interior Routing Protocols
- •Numbering Ports (Interfaces)
72 Chapter 3: Virtual LANs and Trunking
Figure 3-1 Network with Two VLANs Using One Switch
Dino
VLAN 1
Fred
Wilma
VLAN 2
Yes, the concepts behind VLANs are that simple. The use of VLANs does introduce a couple of other concepts you should know. Next you will learn about VLAN trunking, VLAN Trunking Protocol, and some issues related to Layer 3 protocols when using VLANs.
Trunking with ISL and 802.1Q
When using VLANs in networks that have multiple interconnected switches, you need to use VLAN trunking between the switches. With VLAN trunking, the switches tag each frame sent between switches so that the receiving switch knows to what VLAN the frame belongs. Figure 3-2 outlines the basic idea.
Figure 3-2 VLAN Trunking Between Two Switches |
|
|
|
||
Switch 1 |
0/1 |
VLAN 1 |
Switch 2 |
0/1 |
VLAN 1 |
|
0/2 |
|
|
0/2 |
|
|
0/5 |
VLAN 2 |
|
0/5 |
VLAN 2 |
0/23 |
|
|
0/13 |
|
|
Trunk
VLAN ID Ethernet Frame
With trunking, you can support multiple VLANs that have members on more than one switch. For instance, when Switch 1 receives a broadcast from a device in VLAN 1, it needs to forward the broadcast to Switch 2. Before sending the frame, Switch1 adds another header
Trunking with ISL and 802.1Q 73
to the original Ethernet frame; that new header has the VLAN number in it. When Switch 2 receives the frame, it sees that the frame was from a device in VLAN1, so Switch2 knows that it should only forward the broadcast out its own interfaces in VLAN1.
Cisco switches support two different trunking protocols—Inter-Switch Link (ISL) and IEEE 802.1Q. Both provide basic trunking, as shown in Figure 3-2. They do have some differences, as discussed next.
ISL
Cisco created ISL before the IEEE standardized a trunking protocol. Because ISL is Ciscoproprietary, it can be used only between two Cisco switches. ISL fully encapsulates each original Ethernet frame in an ISL header and trailer. The original Ethernet frame inside the ISL header and trailer remains unchanged. Figure 3-3 shows the framing for ISL.
Figure 3-3 ISL Header
ISL Header |
Encapsulated Ethernet Frame |
CRC |
26 bytes |
|
4 bytes |
DA Type User SA LEN AAAA03 HSA VLAN BPDU INDEX RES
VLAN |
BPDU |
The ISL header includes several fields, but most importantly, the ISL header VLAN field provides a place to encode the VLAN number. By tagging a frame with the correct VLAN number inside the header, the sending switch can ensure that the receiving switch knows to which VLAN the encapsulated frame belongs. Also, the source and destination addresses in the ISL header use MAC addresses of the sending and receiving switch, as opposed to the devices that actually sent the original frame. Other than that, the details of the ISL header are not that important.
802.1Q
The IEEE standardizes many of the protocols relating to LANs today, and VLAN trunking is no exception. After Cisco created ISL, the IEEE completed work on the 802.1Q standard, which defines a different way to do trunking.
74 Chapter 3: Virtual LANs and Trunking
802.1Q uses a different style of header than does ISL to tag frames with a VLAN number. In fact, 802.1Q does not actually encapsulate the original frame. Rather, it adds an extra 4-byte header to the original Ethernet header. That additional header includes a field with which to identify the VLAN number. Because the original header has been changed, 802.1Q encapsulation forces a recalculation of the original FCS field in the Ethernet trailer, because the FCS is based on the contents of the entire frame. Figure 3-4 shows the 802.1Q header and framing of the revised Ethernet header.
Figure 3-4 802.1Q Trunking Header
Dest |
Src |
Len/Etype |
Data |
FCS |
Original |
|
|
Frame |
|
|
|||||
|
|
|
|
|
|
|
|
Dest |
Src |
Etype Tag |
Len/Etype |
|
Data |
FCS |
Tagged |
|
Frame |
||||||
|
|
|
|
|
|
|
Priority VLAN-ID
ISL and 802.1Q Compared
Both ISL and 802.1Q provide trunking. The header used by each varies, and only ISL actually encapsulates the original frame, but both allow the use of a 12-bit-long VLAN ID field. So, either works fine, and both support the same number of VLANs because both use a 12-bit VLAN Number field.
ISL and 802.1Q both support a separate instance of spanning tree for each VLAN. ISL supported this feature much earlier than did 802.1Q, so in years past, one of the stated differences between the two trunking protocols was that 802.1Q did not support multiple spanning trees. To appreciate the benefits of multiple spanning trees, examine Figure 3-5, which shows a simple network with two VLANs and three interconnected switches.
Figure 3-5 ISL Per-VLAN Spanning Tree (PVST)
SW1 |
SW2 |
Blocking — VLAN 2 Blocking — VLAN 1
SW3
Trunking with ISL and 802.1Q 75
You can tune STP parameters in each VLAN so that when all links are up, different interfaces block in different spanning trees. In the figure, only one of the six switch interfaces connecting the switches needs to block to prevent loops. STP can be configured so that VLAN 1 and VLAN 2 block different interfaces on SW3 in this example. So, SW3 actually uses the available bandwidth on each of its links to the other switches, because traffic in VLAN 1 uses the link to SW1, and traffic in VLAN 2 uses the link to SW2. Of course, if a link fails when you use ISL, both STP instances can converge so that a path is still available.
Cisco provides a variety of STP tools to accommodate multiple spanning trees. ISL uses a Cisco-proprietary feature called Per-VLAN Spanning Tree (PVST+) to support multiple spanning trees. 802.1Q did not originally support multiple spanning trees, but it can by using a couple other protocols. Cisco’s proprietary PVST+ allows multiple STP instances over
802.1Q trunks. Also, the IEEE has completed a new specification called 802.1S that adds to the 802.1Q specification, allowing multiple spanning trees. In addition to these protocols, Cisco supports other proprietary variations.
A key difference between ISL and 802.1Q relates to a feature called the native VLAN. 802.1Q defines one VLAN on each trunk as the native VLAN; by default, this is VLAN 1. By definition, 802.1Q simply does not encapsulate frames in the native VLAN when sending the frames over the trunk. When the switch on the other side of the link receives a frame in the native VLAN, it notices the lack of an 802.1Q header and knows that the frame is part of the native VLAN.
Native VLANs play a very important role from a practical perspective. Imagine that you have many PCs connected to some switch ports, and those PCs do not understand 802.1Q. You also plan to install IP phones near those PCs. IP phones have a built-in switch so that you can connect the phone to the Ethernet cable from the switch and then connect the phone to a PC. The phone understands 802.1Q, so you can put the phone in one VLAN and the PC in another. You can configure all those ports for 802.1Q, placing the PCs in the native VLAN. They work fine when connected directly to the switch, because the switch does not use any encapsulation for the native VLAN. When you install an IP phone between the switch and the PC, the phone can understand the 802.1Q headers and can send and receive traffic to and from the switch. The phone can just pass the native VLAN traffic between the PC and the switch.
ISL does not use a concept like native VLAN. All frames from all VLANs have an ISL header for transmission across an ISL trunk.