Configuring Ethernet Switch Ports

This section provides the necessary information for configuring Ethernet switch ports.

Configuring VLANs

A VLAN is a switched network that is logically segmented by function, project team, or application, without regard to the physical locations of the users. VLANs have the same attributes as physical LANs, but you can group end stations even if they are not physically located on the same LAN segment. Any switch port can belong to a VLAN, and unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in the VLAN. Each VLAN is considered a logical network, and packets destined for stations that do not belong to the VLAN must be forwarded through a router.

On the ESR6300, all the Gigabit Ethernet LAN ports g0/1/0 through g0/1/4 are set up in vlan1, which does not need to be created.


Note
ESR6300 routers have reserved a set of VLANs (2350 to 2449) for additional usage. It is not allowed to add the reserved VLANs. You must ensure that these VLANs are not used in the network.

Procedure

Step 1

Use the switchport access vlan vlan-id command to assign a port to a VLAN.

Example:

Router# configure terminal
Router(config)# interface g 0/1/0
Router(config-if)# switchport access vlan 4
Router(config-if)# no shut
Router(config-if)# exit
Router(config)# interface vlan 4
Router(config-if)# ipv4 address {ip} {mask}
Router(config-if)# ipv6 enable
Router(config-if)# ipv6 address autoconfig
Router(config-if)# no shut
Router(config-if)# end

Step 2

Use the show run interface g0/1/0 , show interface g0/1/0 , and show vlan commands to verify the configuration.

The port is assigned to the specified VLAN, and the VLAN interface is configured with the assigned IP addressing. The configuration can be confirmed using the show run interface , show interface , and show vlan command outputs.

This is an example of a VLAN configuration:

Router# show vlan
        VLAN  Name                            Status       Ports
        ---- -------------------------------- --------- -------------------------------
        1     default                         active       Gi0/1/0, Gi0/1/1, Gi0/1/2 Gi0/1/3
        1002  fddi-default                    act/unsup
        1003  token-ring-default              act/unsup
        1004  fddinet-default                 act/unsup
        1005  trnet-default                   act/unsup
        
        VLAN  Type  SAID      MTU   Parent  RingNo BridgeNo Stp BrdgMode Trans1 Trans2
        ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
        1     enet  100001     1500  -       -      -       -   -         0      0
        1002  fddi  101002     1500  -       -      -       -   -         0      0
        1003  tr    101003     1500  -       -      -       -   -         0      0
        1004  fdnet 101004     1500  -       -      -       ieee -        0      0
        1005  trnet 101005     1500  -       -      -       ibm  -        0      0
        
        Primary Secondary Type Ports
        ------- --------- ----------------- ------------------------------------------
        Router#

What to do next

IOS-XE supports Embedded Packet Capture (EPC), which provides an embedded systems management facility that helps in tracing and troubleshooting packets. This feature allows network administrators to capture data packets flowing through, to, and from a Cisco device.

The network administrator may define the capture buffer size and type (circular or linear), the maximum number of bytes of each packet to capture, and the direction of the traffic flow—ingress or egress, or both. The packet capture rate can be throttled using further administrative controls.

For example, you can use the available options for filtering the packets to be captured using an Access Control List and, optionally, further define the capture by specifying a maximum packet capture rate or by specifying a sampling interval. For additional details, see Embedded Packet Capture Configuration Guide, Cisco IOS XE Gibraltar 16.10.x.

VLAN trunking protocol (VTP)

VTP is a Layer 2 messaging protocol that

  • maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis

  • minimizes mis-configurations and configuration inconsistencies that can cause problems such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations, and

  • enables centralized configuration changes on one or more switches with automatic communication to all other switches in the network.

VTP operation characteristics

Before you create VLANs, you must decide whether to use VTP in your network. Using VTP, you can make configuration changes centrally on one or more switches and have those changes automatically communicated to all the other switches in the network. Without VTP, you cannot send information about VLANs to other switches.

VTP is designed to work in an environment where updates are made on a single switch and are sent through VTP to other switches in the domain. It does not work well in a situation where multiple updates to the VLAN database occur simultaneously on switches in the same domain, which would result in an inconsistency in the VLAN database.

Further information about configuring VTP can be found here: http://www.cisco.com/c/en/us/td/docs/routers/access/interfaces/software/feature/guide/geshwic_cfg.html#wp1046901

802.1x authentication

IEEE 802.1x port-based authentication is a client-server-based access control and authentication protocol that:

  • prevents unauthorized clients from connecting to a LAN through publicly accessible ports,

  • requires authentication server validation before allowing access to switch or LAN services, and

  • allows only Extensible Authentication Protocol over LAN (EAPOL), Cisco Discovery Protocol (CDP), and Spanning Tree Protocol (STP) traffic through the port until the client is authenticated.

Device roles in 802.1x authentication

With IEEE 802.1x authentication, the devices in the network have specific roles:

  • Supplicant—Device (workstation) that requests access to the LAN and switch services and responds to requests from the router. The workstation must be running IEEE 802.1x-compliant client software such as that offered in the Microsoft Windows XP operating system. (The supplicant is sometimes called the client.)

  • Authentication server—Device that performs the actual authentication of the supplicant. The authentication server validates the identity of the supplicant and notifies the router whether or not the supplicant is authorized to access the LAN and switch services. The Network Access Device transparently passes the authentication messages between the supplicant and the authentication server, and the authentication process is carried out between the supplicant and the authentication server. The particular EAP method used will be decided between the supplicant and the authentication server (RADIUS server). The RADIUS security system with EAP extensions is available in Cisco Secure Access Control Server Version 3.0 or later. RADIUS operates in a client and server model in which secure authentication information is exchanged between the RADIUS server and one or more RADIUS clients.

  • Authenticator—Router that controls the physical access to the network based on the authentication status of the supplicant. The router acts as an intermediary between the supplicant and the authentication server, requesting identity information from the supplicant, verifying that information with the authentication server, and relaying a response to the supplicant. The router includes the RADIUS client, which is responsible for encapsulating and decapsulating the EAP frames and interacting with the authentication server.


Note
The ESR6300 supports authentication/authorization from TACACS+ server as well.

For detailed information on how to configure 802.1x port-based authentication, see this link:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/15-mt/sec-user-8021x-15-mt-book/config-ieee-802x-pba.html

Enabling IEEE 802.1x and AAA on a switch port

This example shows how to configure an ESR6300 router as 802.1x authenticator:

Router> enable
Router# configure terminal
Router(config)# dot1x system-auth-control
Router(config)# aaa new-model
Router(config)# aaa authentication dot1x default group radius
Router(config)# interface GigabitEthernet0/1/0
Router(config-if)# switchport mode access
Router(config-if)# access-session port-control auto
Router(config-if)# dot1x pae authenticator
Router(config-if)# access-session closed
Router(config-if)# access-session host-mode single-host
Router(config-if)# end

Configure spanning tree protocol

Spanning Tree Protocol (STP) is configured to manage Layer 2 links by providing path redundancy while preventing network loops.

Spanning Tree Protocol (STP) is a Layer 2 link management protocol that provides path redundancy while preventing loops in the network. For a Layer 2 Ethernet network to function properly, only one active path can exist between any two stations. Multiple active paths among end stations cause loops in the network. If a loop exists in the network, end stations might receive duplicate messages. Switches might also learn end-station MAC addresses on multiple Layer 2 interfaces. These conditions result in an unstable network. Spanning-tree operation is transparent to end stations, which cannot detect whether they are connected to a single LAN segment or a switched LAN of multiple segments.

The STP uses a spanning-tree algorithm to select one switch of a redundantly connected network as the root of the spanning tree. The algorithm calculates the best loop-free path through a switched Layer 2 network by assigning a role to each port based on the role of the port in the active topology:

  • Root—A forwarding port elected for the spanning-tree topology

  • Designated—A forwarding port elected for every switched LAN segment

  • Alternate—A blocked port providing an alternate path to the root bridge in the spanning tree

  • Backup—A blocked port in a loopback configuration

The switch that has all of its ports as the designated role or as the backup role is the root switch. The switch that has at least one of its ports in the designated role is called the designated switch. Spanning tree forces redundant data paths into a standby (blocked) state. If a network segment in the spanning tree fails and a redundant path exists, the spanning-tree algorithm recalculates the spanning-tree topology and activates the standby path. Switches send and receive spanning-tree frames, called bridge protocol data units (BPDUs), at regular intervals. The switches do not forward these frames but use them to construct a loop-free path. BPDUs contain information about the sending switch and its ports, including switch and MAC addresses, switch priority, port priority, and path cost. Spanning tree uses this information to elect the root switch and root port for the switched network and the root port and designated port for each switched segment.

When two ports on a switch are part of a loop, the spanning-tree port priority and path cost settings control which port is put in the forwarding state and which is put in the blocking state. The spanning-tree port priority value represents the location of a port in the network topology and how well it is located to pass traffic. The path cost value represents the media speed.

For detailed configuration information on STP, see: STP Configuration Guide.

Procedure

Step 1

Use the spanning-tree vlan vlan-id port-priority command to configure spanning-tree port priority for a Gigabit Ethernet interface.

Example:

Router# configure terminal
Router(config)# interface GigabitEthernet0/1/0
Router(config-if)# spanning-tree vlan 1 port-priority 64
Router(config-if)# end

If a loop occurs, spanning tree uses the port priority when selecting an interface to put in the forwarding state.

Step 2

Use the spanning-tree cost command to change the spanning-tree port cost for a Gigabit Ethernet interface.

Example:

Router# configure terminal
Router(config)# interface GigabitEthernet0/1/0
Router(config-if)# spanning-tree cost 18
Router(config-if)# end

If a loop occurs, spanning tree uses cost when selecting an interface to put in the forwarding state.

Step 3

Use the spanning-tree vlan vlan-id priority command to configure the bridge priority for a VLAN.

Example:

Router# configure terminal
Router(config)# spanning-tree vlan 10 priority 33792
Router(config)# end

Step 4

Use the spanning-tree vlan vlan-id hello-time command to configure the hello time for a VLAN.

Example:

Router# configure terminal
Router(config)# spanning-tree vlan 10 hello-time 7
Router(config)# end

The hello time is the interval between the generation of configuration messages by the root switch.

Step 5

Use the spanning-tree vlan vlan-id forward-time command to configure the forward delay time for a VLAN.

Example:

Router# configure terminal
Router(config)# spanning-tree vlan 10 forward-time 21
Router(config)# end

The forward delay is the number of seconds an interface waits before changing from its spanning-tree learning and listening states to the forwarding state.

Step 6

Use the spanning-tree vlan vlan-id max-age command to configure the maximum age interval for the spanning tree.

Example:

Router# configure terminal
Router(config)# spanning-tree vlan 20 max-age 36
Router(config)# end

The maximum-aging time is the number of seconds a switch waits without receiving spanning-tree configuration messages before attempting a reconfiguration.

Step 7

Use the spanning-tree vlan vlan-id root primary diameter command to configure the switch as the root bridge for a VLAN with the specified network diameter.

Example:

Router# configure terminal
Router(config)# spanning-tree vlan 10 root primary diameter 4
Router(config)# exit

Spanning Tree Protocol is configured with the specified parameters for port priority, cost, bridge priority, timing intervals, and root bridge designation to manage Layer 2 network topology and prevent loops.

Example

The example shows configuring the bridge priority of VLAN 10 to 33792:

Router# configure terminal
Router(config)# spanning-tree vlan 10 priority 33792
Router(config)# end

The example shows configuring the hello time for VLAN 10 being configured to 7 seconds:

Router# configure terminal
Router(config)# spanning-tree vlan 10 hello-time 7
Router(config)# end

The example shows configuring forward delay time:

Router# configure terminal
Router(config)# spanning-tree vlan 10 forward-time 21
Router(config)# end

The example shows the switch being configured as the root bridge for VLAN 10, with a network diameter of 4:

Router# configure terminal
Router(config)# spanning-tree vlan 10 root primary diameter 4
Router(config)# exit

MAC address table manipulation

MAC address table manipulation is a network administration process that

  • configures address information that the switch uses to forward traffic between ports

  • manages both dynamic and static MAC address entries in the forwarding table, and

  • controls aging time settings to define retention periods for unseen addresses.

MAC address types

The MAC address table contains these types of addresses:

  • Dynamic address: a source MAC address that the switch learns and then drops when it is not in use. You can use the aging time setting to define how long the switch retains unseen addresses in the table.

  • Static address: a manually entered unicast address that does not age and that is not lost when the switch resets.

The address table lists the destination MAC address, the associated VLAN ID, and port associated with the address and the type (static or dynamic).

For detailed configuration information on MAC address table manipulation see this link:

http://www.cisco.com/c/en/us/td/docs/routers/access/interfaces/software/feature/guide/geshwic_cfg.html#wp1048223

This example shows creating a static entry in the MAC address table:
Router# configure terminal
Router(config)# mac address-table static 0002.0003.0004 interface GigabitEthernet0/1/0 vlan 3
Router(config)# end

This example shows setting the aging timer:

Router# configure terminal
Router(config)# mac address-table aging-time 300
Router(config)# end

Configure switch port analyzer

Configure Switch Port Analyzer to analyze network traffic passing through ports by sending a copy of the traffic to another port connected to a network analyzer or other monitoring or security device.

The Cisco ESR6300 supports local SPAN only, and up to one SPAN session. SPAN copies (or mirrors) traffic received or sent (or both) on source ports to a destination port for analysis. SPAN does not affect the switching of network traffic on the source ports. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic.

Only traffic that enters or leaves source ports or traffic that enters or leaves source can be monitored by using SPAN; traffic routed to a source cannot be monitored. For example, if incoming traffic is being monitored, traffic that gets routed from another source cannot be monitored; however, traffic that is received on the source and routed to another can be monitored.

For detailed information on how to configure a switched port analyzer (SPAN) session, see the following web link: SPAN Configuration Guide.

Procedure

Step 1

Use the monitor session session-number source command to configure a SPAN session to monitor bidirectional traffic from an interface.

Example:

Router# configure terminal
            Router(config)# monitor session 1 source GigabitEthernet0/1/0
            Router(config)# end

Step 2

Use the monitor session session-number destination command to configure an interface as the destination for a SPAN session.

Example:

Router# configure terminal
            Router(config)# monitor session 1 destination GigabitEthernet0/1/0
            Router(config)# end

Step 3

Use the no monitor session session-number source command to remove the interface as a SPAN source for SPAN session 1 if needed.

Example:

Router# configure terminal
            Router(config)# no monitor session 1 source GigabitEthernet0/1/0
            Router(config)# end

The SPAN session is configured to monitor network traffic from the specified source interface and copy it to the destination interface for analysis.

IGMP snooping

IGMP snooping is a Layer 2 switching feature that

  • constrains the flooding of multicast traffic by dynamically configuring Layer 2 interfaces so that multicast traffic is forwarded to only those interfaces associated with IP multicast devices

  • requires the LAN switch to snoop on the IGMP transmissions between the host and the router and to keep track of multicast groups and member ports, and

  • adds and removes host ports from forwarding table entries based on IGMP report and Leave Group messages, while periodically deleting entries if it does not receive IGMP membership reports from multicast clients.

IGMP snooping operation

The multicast router sends out periodic general queries to all VLANs. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry.

When the switch receives an IGMP report from a host for a particular multicast group, the switch adds the host port number to the forwarding table entry; when it receives an IGMP Leave Group message from a host, it removes the host port from the table entry.

Use the IP IGMP snooping enable command to configure IGMP Snooping on the ESR6300.

By default, IGMP snooping is globally enabled in the ESR6300.

MLD snooping is also supported on the ESR6300, and further information can be found in this documentation set: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-1/configuration_guide/b_161_consolidated_3850_cg/b_161_consolidated_3850_cg_chapter_01100.html