COMPLETE STUDY
OF
VLAN & VoIP
By Arpit Sinha Course Code KKMOD07
Acknowledgments
My number one acknowledgment always goes to God who has blessed me in more ways than I even realize. Please allow me to use these talents to accomplish more for your kingdom than an Ethernet cable ever could.
Thanks to our Faculty Mr. Soumya Hazra. His support is immeasurable.
Introduction
One of the underlying problems with Layer 2 switches is that excessive broadcast and multicast traffic can affect other devices in a switched network because bridges and switches flood these types of messages. If you are a receiver of all this excessive traffic, you have to waste processing utilization and endure wasted bandwidth even if those devices are not in your department. VLAN solves broadcast concern by segmenting broadcast domains at Layer 2 and how they affect your switched network design.
Overview
VLAN is a logical group of Routers. A single Switch or can be spread among multiple Switches. A single VLAN must be in a single subnet.
1VLAN = 1 Subnet = 1 Broadcast Domain
What is also remarkable about VLANs is that because each VLAN represents a broad cast domain in which devices can communicate only with other devices in that same VLAN, there must be a separate instance of Spanning Tree Protocol (STP) running for each VLAN. In other words, if you have 20VLANs running in your switched network, you will have 20 instances of running, each with its own root bridge. The term for this ability to have a separate instance of Spanning Tree Protocol for each VLAN is called PVST (per VLAN Spanning Tree).
Configuration
Objective:
Ø Configure, verify, and troubleshoot VLAN
All the interfaces are already assigned to VLAN 1. To create smaller broadcast domains in your switch, you must create those VLANs for each department you want to segment and assign them to their respective interfaces. Specifically, the configuration steps for VLANs are as follows:
- Create the VLAN, using a number between 2 to 1001.
- Name the VLAN. If you do not assign it a name, it uses VLANxxxx, where xxxx is the VLAN number.
- Assign it to a switch port.
VLAN specific configuration are permanently stored in Flash memory in a special file called the VLAN database (vlan.dat). To configure VLAN on the Catalyst Switch, you must navigate to a VLAN configuration mode from global configuration referred to as config-VLAN mode.
To navigate to this configuration mode, you type the command vlan followed by the VLAN ID you want to create. At this point, the prompt changes to Switch ( config-vlan)#, signifying that you are in config-VLAN mode. At this stage of the VLAN configuration, you have the option to assign a unique name to the VLAN you just create by typing the keyword name followed by the custom name of your VLAN. If you choe the number 4 for the VLAN ID, the VALN name defaults to VLAN0004.
Switch#vlan database
Switch(vlan)#vlan 2 name arpit
Switch(vlan)#apply
Switch(vlan)#vlan 3 name kaushik
Switch(vlan)#apply
Switch(vlan)#exit
Switch #configure terminal
Switch (config) #interface FastEthernet 0/1
Note: F0/1 is a trunk port.
Switch (config-if)#switchport mode trunk
Switch (config-if)#exit
Switch (config)#interface FastEthernet 0/2
Switch (config-if)#switchport access vlan 2
Switch (config-if)#exit
Switch (config)#interface FastEthernet 0/3
Switch (config-if)#switchport access vlan 2
Switch (config-if)#exit
Switch (config)#interface FastEthernet 0/4
Switch (config-if)#switchport access vlan 3
Switch (config-if)#exit
Switch (config)#interface FastEthernet 0/5
Switch (config-if)#switchport access vlan 3
Switch (config-if)#exit
Switch (config)#^Z
Switch# copy running-config startup-config
After configuring switch by giving all the required parameters go to the Router’s global configuration mode and assign the values as furnished below:
Router(config)# interface FastEthernet 0/0
Router(config-if)#no shut
Router(config-if)#exit
Router(config)#interface FastEthernet 0/0.2
Router(config-subif)#encapsulation dot1q 2
Router(config-subif)#ip address 192.168.10.1 255.255.255.0
Router(config-subif)#no shut
Router(config-subif)#exit
Router(config)#interface FastEthernet 0/0.3
Router(config-subif)#encapsulation dot1q 3
Router(config-subif)#ip address 192.168.100.1 255.255.255.0
Router(config-subif)#exit
Router(config)#exit
Router#copy running-config startup-config
Because these VLAN configurations are stored in the VLAN database, they will not be displayed in the running or startup configs. Instead, to verify your VLAN configuration, use the show vlan command to observe the VLANs that you created and interfaces to which they are applied.
Access port of a switch can only read and process the standard Ethernet frame(Frame not encapsulated with ISL or dot1q).
Trunk port of a switch reads and processes the standard Ethernet frame.
Blocking State (20 Seconds):-
In this state switch port does not receive or send any frame, but only listen to BPDU (Bridge protocol data unit).
Listening State (15 Seconds):-
In this state switch port can identify any collision in the media but does not receive or send any frame only listen to BPDU.
In this state a switch port learns the MAC entries and populates the MAC table. Only listen to BPDU.
In this state a\switch port can receive or send frame and also listens to BPDU.
A switch port takes 50 seconds by defaults to change its state from blocking to forwarding state and this time is known as forward delay time.
ISL Trunks
The VLAn identification is added to Layer 2 ethernet frames differently, depending on the type of trunk that is configured. Cisco’s proprietary method of adding VLAN ID to an Ethernet frame is called Inter Switch link(ISL). ISL trunking entails the original Ethernet frame being encapsulated by ASCI chips with the VLAN information. The ISL encapsulation has a 26-bytes header and an additional 4 bytes CRC trailer at the end. Because an additional 30 bytes are added to the Ethernet frame, the size of the frame can exceed a typical Ethernet frame size of 1518 bytes. If the interface isn’t configured as an ISL trunk, it drops the giant frame because it violates the MTU limit of a typical Ethernet frame. For this reason, ISL requires a direct point-to-point (no intermediate devices) trunk connection between the switches.
802.1q Trunks
The IEEE created its own standard VLAN tagging method standardized as 802.1q. 802.1q differ from ISL because the VLAN ID is not encapsulated, but actually inserted in the originally Ethernet frame. The VLAN identifier is contained within the four extra bytes inserted in the Ethernet frame after the source address. Because the original frame size is manipulated when these four bytes are added to the frame, a new CRC must be calculated for the original Ethernet frame check sequence (FCS) field. Because only four bytes are added to the Ethernet frame, these frames are known as baby giant frames and may be passed by other intermediary Layer-2 devices that are not configured as a trunk.
Native VLAN
Another unique feature of 802.1q trunks is the concept of a native VLAN. Traffic originating from access ports that shares the same VLAN as the trunk’s native VLAN goes untagged over the trunk link. Similarly, any untagged frame that is received on an 802.1q trunk port is considered destined for the native VLAN assigned to the trunk port. For this reason, it is imperative that each side of the IEEE 802.1q link be configured with the same native VLAN, or the traffic from one VLAN leaks into another VLAN. By default, the native VLAN for trunk ports is the same as the management VLAN, VLAN1.
Configuring and verifying ISL and 802.1Q Tunks
Objective:
Ø Configure, verify, and trouble trunking on Cisco switches
To configure a Trunk port, navigate to the interface that is connected to the other switch. On models that support ISL and 802.1q trunking, you must first specify which VLAN tagging you want to use with the switchport trunk encapsulation command, as shown here:
Switch(config)#interface FastEthernet 0/24
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
VTP Modes
VTP operates in one of the three modes: server mode, transparent mode, or client mode. You can complete different tasks depending on the VTP operation mode. The following describes the characteristics of the three modes:
Server Mode: The default VTP mode is server mode, but VLAN are not propagate over the network until a management domain name is specified or learned. When you create, modify, or delete a VLAN on a VTP server, the change is propagate to all switches in the VTP domains. VTP message are transmitted out all trunk connections. VTP advertisements are both originated and forwarded. VLAN information is saved in nonvolatile random-access memory (NVRAM).
Transparent Mode: When you create, modify, or delete VLAN in VTP transparent mode, the changes affects only the local switch an does not propagate to other switches in the VTP domain. VTP advertisements are forwarded, but not originated on the switch. The VLAN information is not synchronized with other switches. The VLAN information is saved in NVRAM.
Client Mode: You cannot create, modify, or delete VLANs when in VTP client mode. VTP advertisements are forwarded in VTP client mode. VLAN information is synchronized with other VTP clients and servrs. VLAN information is not saved in NVRAM.
Configuring and Verifying VTP
Objective:
Ø Configure, verify, and troubleshoot VTP
Switch#configure terminal
Switch(config)#vtp domain CCNA
Switch(config)#vtp password arpit
To change the default VTP mode from server to client or transparent, you simply need to use the vtp mode command in global configuration followed by the mode you wish the switch to participate in:
Switch(config)#vtp mode transparent
Switch#show vtp status
Voice VLANs
Access ports are ports that only have one VLAN assigned to them. That is typically the case unless you want to assign Voice VLANs, sometimes referred to as auxiliary VLANs, to an interface. In these cases, the access VLAN is actually the VLAN assigned for normal data and voice VLAN is a separate VLAN for Voice over IP (VoIP) from Cisco IP Phone.
Cisco IP Phone, such as the 7960, connect to switches and send the IP traffic that contains the voice payloads over the LAN and eventually to gateway device that connects it to the traditional voice network. In addition to having responsibility of breaking down speech and sound into data packets, these IP Phones also have an internal LAN switch with a data port on them that you can use to connect your PC or other end-device to minimize unnecessary cabling and the amount of ports needed on the Catalyst switch.
By configuring the switch port connected to these phones, you have the ability to logically separate the voice traffic from the phone and the data traffic traversing through the phone’s internal switch into separate broadcast domains. This is useful for management purpose because you can essentially configure all IP Phones to be in their own subnet because the phones will be assigned to the same voice VLAN. But even more important than that, you can configure the catalyst switch to use QoS and instruct the IP Phone (using CDP no less) to classify the voice traffic differently from the data. By giving the voice traffic higher priority over the data traffic, you are minimizing the possibility (at least from the catalyst switch) and deteriorate voice quality.
Switch(config)#interface FastEthernet 0/1
Switch(config-if)#switchport access vlan 100
Switch(config-if)#switchport voice vlan 200
Challenge
The concepts and configurations are very critical to comprehend for the CCNA exam. The following challenge tests your comprehension of the concepts and configuration of VLANs, trunks, and VTP.
1. How many broadcast domains are present in the switch by default and what VLAN(s) are present?
2. Enter global configuration and change your VTP domain to VTPMaster.
3. Create the VTP password for the domain to be allhailme.
4. Change the VTP mode to client.
5. You need to create two separate broadcast domains in your local switch for the CCNA and the Sales departments. Configure them with VLAN numbers 100 and 200, respectively, and apply the configuration.
Why will this fail?
6. Change your VTP mode back to the default, add the VLANs, and exit the VLAN database.
7. Apply VLAN 100 to interface Fast Ethernet 0/1.
8. Apply VLAN 200 to interface Fast Ethernet 0/2.
9. Make Fast Ethernet 0/24 an interface to carry all VLAN traffic to a neighboring switch, using the IEEE standard VLAN tagging.
Challenge Answer
In solving this Challenge the switch is configured, by default, for a single broadcast domain in the management VLAN 1. The configuration for steps 1–4 is as follows:
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#vtp domain VTPMaster
Changing VTP domain name from NULL to VTPMaster
Switch(config)#vtp password allhailme
Setting device VLAN database password to allhailme
Switch(config)#vtp client
Setting device to VTP CLIENT mode.
Any VLAN creation will fail at this point because you cannot add, change, or delete VLANs in VTP client mode. The remaining configuration steps are demonstrated here:
Switch(config)#vtp server
Setting device to VTP SERVER mode.
Switch(config)#vlan 100
Switch(config-vlan)#name CCNA
Switch(config-vlan)#exit
Switch(config)#vlan 200
Switch(config-vlan)#name Sales
Switch(config-vlan)#exit
Switch(config)#interface FastEthernet 0/1
Switch(config-if)#switchport access vlan 100
Switch(config-if)#exit
Switch(config)#interface FastEthernet 0/2
Switch(config-if)#switchport access vlan 200
Switch(config-if)#exit
Switch(config)#interface FastEthernet 0/24
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
Troubleshooting VLAN
Objectives:
. Configure, verify, and troubleshoot VLANs
. Configure, verify, and troubleshoot trunking on Cisco switches
. Configure, verify, and troubleshoot interVLAN routing
. Configure, verify, and troubleshoot VTP
I am sure by this point you recognize the usefulness of segmenting your LAN into separate broadcast domains using VLANs. Unfortunately, this valuable Layer 2 technology is not without its share of problems that can (and typically do) arise when implementing VLANs in a switched environment. By logically narrowing down the possible causes based upon the symptoms and using the verification commands learned in this chapter, you should be able to tackle the majority of anomalies that occur in a small-to-medium sized switched network with VLANs. One of the most common symptoms that may arise when implementing VLANs is the inability to have end-devices able to communicate with each other. The list of possible causes for this can be endless; however, the following questions and solutions will address the most prevalent problems:
1. Is this one of the design requirements of implementing VLANs in the first place? Recall that a major benefit of VLANs is to logically separate traffic into separate broadcast domains. If devices are in separate VLANs and do not have a router or Layer 3 switch to route in between the VLANs, then this is the result that is supposed to occur.
2. Are the trunks operating correctly between the switches? Assuming that you have multiple switches, verify the configuration and the status of the switch trunks by using the show interfaces trunk command. If the trunk link is not operating correctly, use the OSI model as a guide and begin with the Physical layer by verifying the cable between the switches is a cross-over ethernet cable. Once that is verified, move up to the Data Link layer and check your trunk configuration. Specifically, make sure trunk negotiation was successful, especially if your network is not an all-Cisco switched network. When in doubt, manually configure each side of the link to trunk by using the switchport mode trunk command.
3. Are the end-devices assigned to the correct VLANs? If they are designed to be in the same VLAN, verify the VLAN names match and they are assigned to the correct interfaces by using the show vlans command. If they are on separate VLANs, verify your configuration and the status of the interfaces on your router or your Layer 3 switch. In addition, ensure that the end-devices are utilizing the IP address of the subinterface or switched virtual interface as their default gateway.
4. If using 802.1q trunks, are both switches sharing the trunk using the same native VLAN? Recall that VLAN leakage can occur if both sides of the trunk are not configured with the same VLAN. Verify the native VLAN on both switches by utilizing the show interfaces trunk command. The next troubleshooting scenario we will look at revolves around the possibility that output of the show vlan command reveals that your VLANs in your switch are missing or are inconsistent with what you originally configured in the rest of your switches:
1. Is your switch in VTP transparent mode? Mismatched VLANs is not only possible in transparent mode, but it is actually one of the reasons to use transparent mode. In addition, it might also explain why you do not see your VLANs since they will not show up in the VLAN database, but they can be found in your running or startup configuration.
2. Are the VTP configuration revision numbers incrementing along with the other switches in the network? It is plausible that the switch has lost a connection to the rest of the switched network. Verify the trunk is configured and operating as mentioned in the first scenario. Secondly, it may be possible that the management VLAN (VLAN 1 by default) is being blocked from propagating between the trunks (we will look into how to change the management VLAN and only allow certain VLANs over trunks , “Implementing Switch Security.”) Recall that the management IP, CDP, and VTP advertisements all are advertised using the management VLAN between switches. As a result, if the management VLAN is being blocked, VTP advertisements are consequently being blocked as well. Finally, there may be a switch that was added to your network between you and the VTP server that is configured for a different VTP domain. When the VTP server sends its VTP advertisements to the interjector switch, it will discard the VTP advertisement because it is not in the same VTP domain. The end result is that your switch never receives those VTP advertisements and your VTP configuration revisions will not increase.
3. Is there another VTP server in your switched internetwork? It is common to have several VTP servers in a network for redundancy; however, if another administrator is adding, changing, and/or removing VLANs on other VTP server switches, it will increment its configuration revision and all other switches in client and server mode will follow suit. If a VTP server is added and does not have any VLANs configured, that would explain it if all of your configured VLANs have suddenly disappeared as well. You can verify this by issuing the show vtp status command which will show you the IP address of the last VTP updater if known.
4. Has there been any configuration changes to the VTP domain or VTP passwords? If your switch does not have matching VTP domain names or VTP passwords, the switch will not accept VTP advertisements. This can be verified using the show vtp status command on each switch. If you suspect the password is not matching, use the show vtp password command from privileged EXEC.
