Computer Certification

CCNA and CCNP candidates are well-versed in Spanning-Tree Protocol
and one of the great things about STP is that it works well with little or no additional configuration. There is one situation where STP works against us just a bit while it prevents switching loops
and that is the situation where two switches have multiple physical connections.

You would think that if you have two separate physical connections between two switches
twice as much data could be sent from one switch to the other than if there was only one connection. STP doesn't allow this by default
however in an effort to prevent switching loops from forming
one of the paths will be blocked.

SW1 and SW2 are connected via two separate physical connections
on ports fast0/11 and fast 0/12. As we can see here on SW1
only port 0/11 is actually forwarding traffic. STP has put the other port into blocking mode (BLK).


SW1#show spanning vlan 10


(some output removed for clarity)


Interface Role Sts Cost Prio.Nbr Type


Fa0/11 Root FWD 19 128.11 P2p

Fa0/12 Altn BLK 19 128.12 P2p


While STP is helping us by preventing switching loops
STP is also hurting us by preventing us from using a perfectly valid path between SW1 and SW2. We could literally double the bandwidth available between the two switches if we could use that path that is currently being blocked.

The secret to using the currently blocked path is configuring an Etherchannel. An Etherchannel is simply a logical bundling of 2 - 8 physical connections between two Cisco switches.

Configuring an Etherchannel is actually quite simple. Use the command "channel-group 1 mode on" on every port you want to be placed into the Etherchannel. Of course
this must be done on both switches if you configure an Etherchannel on one switch and don't do so on the correct ports on the other switch
the line protocol will go down and stay there.

The beauty of an Etherchannel is that STP sees the Etherchannel as one connection. If any of the physical connections inside the Etherchannel go down
STP does not see this
and STP will not recalculate. While traffic flow between the two switches will obviously be slowed
the delay in transmission caused by an STP recalculation is avoided. An Etherchannel also allows us to use multiple physical connections at one time.

Here's how to put these ports into an Etherchannel:

SW1#conf t

Enter configuration commands
one per line. End with CNTL/Z.

SW1(config)#interface fast 0/11

SW1(config-if)#channel-group 1 mode on

Creating a port-channel interface Port-channel 1


SW1(config-if)#interface fast 0/12

SW1(config-if)#channel-group 1 mode on



SW2#conf t

Enter configuration commands
one per line. End with CNTL/Z.

SW2(config)#int fast 0/11

SW2(config-if)#channel-group 1 mode on

SW2(config-if)#int fast 0/12

SW2(config-if)#channel-group 1 mode on


The command "show interface trunk" and "show spanning-tree vlan 10" will be used to verify the Etherchannel configuration.


SW2#show interface trunk (some output removed for clarity)


Port Mode Encapsulation Status Native vlan

Po1 desirable 802.1q trunking 1


SW2#show spanning vlan 10 (some output removed for clarity)


Interface Role Sts Cost Prio.Nbr Type


Po1 Desg FWD 12 128.65 P2p


Before configuring the Etherchannel
we saw individual ports here. Now we see "Po1"
which stands for the interface "port-channel1". This is the logical interface created when an Etherchannel is built. We are now using both physical paths between the two switches at one time!

That's one major benefit in action let's see another. Ordinarily
if the single open path between two trunking switches goes down
there is a significant delay while another valid path is opened - close to a minute in some situations. We will now shut down port 0/11 on SW2 and see the effect on the etherchannel.

SW2#conf t

Enter configuration commands
one per line. End with CNTL/Z.

SW2(config)#int fast 0/11

SW2(config-if)#shutdown

3w0d: %LINK-5-CHANGED: Interface FastEthernet0/11
changed
state to administratively down


SW2#show spanning vlan 10


VLAN0010

Spanning tree enabled protocol ieee

Interface Role Sts Cost Prio.Nbr Type


Po1 Desg FWD 19 128.65 P2p



SW2#show interface trunk


Port Mode Encapsulation Status Native vlan


Po1 desirable 802.1q trunking 1

The Etherchannel did not go down! STP sees the Etherchannel as a single link therefore
as far as STP is concerned
nothing happened.

Building an Etherchannel and knowing how it can benefit your network is an essential skill for CCNA and CCNP success
and it comes in very handy on the job as well. Make sure you are comfortable with building one before taking Cisco's exams!

To pass the Cisco CCNA and CCNP certification exams
as well as becoming a world-class networker
you've got to know how and when to use floating static routes. And if you're wondering what makes them "float" -- read on!

In this example
R1 and R2 are running OSPF over a Frame Relay network
172.12
/24. They're also connected by a BRI ISDN link
172.12
/24. R1 is advertising a loopback network
1.1
/32
via OSPF. We want R2 to have a route to that loopback even if the frame goes down - and here
we'll use a floating static route to make that happen.

R2 sees the route to the loopback interface via OSPF
and can ping that interface successfully.

R2#show ip route ospf

1.0.0.0/32 is subnetted
1
subnets

O 1.1.1.1 [110/65] via 172.12.123.1
0
Serial0


R2#ping 1.1.1.1

Type escape sequence to abort.

Sending 5
100
ICMP Echos to 1.1.1.1
timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5)
round-trip min/avg/max = 68/68/68 ms

This is when it's important to know your administrative distances.... or at least know where to look to see them! The AD of OSPF is 110
which means we can configure a static route to 1.1.1.1 /32
and as long as the AD of the static route is higher than 110
it won't be used unless the OSPF route leaves the routing table. That's why this kind of route is called a "floating" static route - the route "floats" in the routing table and isn't seen unless the primary route leaves the table.

You learned how to write a static route in your CCNA studies
but you also remember that the default AD of a static route is either 1 or 0... and both of those values are less than 110! To change the AD of a static route
configure the desired distance at the end of the ip route command.

R2(config)#ip route 1.1.1.1 255.255.255.255 bri0 ?

<1-255> Distance metric for this route

A.B.C.D Forwarding router's address

name Specify name of the next hop

permanent permanent route

tag Set tag for this route


R2(config)#ip route 1.1.1.1 255.255.255.255 bri0 111

The static route has an AD that's only one higher than that of the OSPF route
but that's enough to make the route "float" and not yet be seen in the routing table.

R2#show ip route

1.0.0.0/32 is subnetted
1
subnets

O 1.1.1.1 [110/65] via 172.12.123.1
0
Serial0

172.12.0.0/24 is subnetted
2
subnets

C 172.12.12.0 is directly connected
BRI0

C 172.12.123.0 is directly connected
Serial0

Let's see the effect on the routing table when the Serial0 interface is closed.

R2(config)#int s0

R2(config-if)#shutdown


12:04:53: %OSPF-5-ADJCHG: Process 1
Nbr 172.12.123.1 on Serial0 from FULL to DOWN
Neighbor Down: Interface down or detached


12:04:55: %SYS-5-CONFIG_I: Configured from console by console

12:04:55: %LINK-5-CHANGED: Interface Serial0
changed state to administratively down


12:04:56: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0
changed state to down


R2#show ip route

1.0.0.0/32 is subnetted
1
subnets

S 1.1.1.1 is directly connected
BRI0

172.12.0.0/24 is subnetted
1
subnets

C 172.12.12.0 is directly connected
BRI0

The floating static route appears in the table
but the ISDN link will not come up until the BRI interface has traffic to send. Let's ping 1.1.1.1 and see what happens. debug dialer was configured on R2 before sending the ping.

R2#ping 1.1.1.1

Type escape sequence to abort.

Sending 5
100
ICMP Echos to 1.1.1.1
timeout is 2 seconds:

12:16:01: BR0 DDR: Dialing cause ip (s=172.12.12.2
d=1.1.1.1)

12:16:01: BR0 DDR: Attempting to dial 8358661

12:16:01: %LINK-3-UPDOWN: Interface BRI0:1
changed state to up.!!

12:16:01: BR0:1 DDR: dialer protocol up!!

Success rate is 80 percent (4/5)
round-trip min/avg/max = 36/37/40 ms

The link comes up and traffic can still reach 1.1.1.1. Once R2 becomes an OSPF neighbor of R1 again
the OSPF route will again become the primary path and the floating static route leaves the routing table.

R2(config)#int s0

R2(config-if)#no shut

R2#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

172.12.123.1 1 FULL/DR 00:01:57 172.12.123.1 Serial0


R2#show ip route

1.0.0.0/32 is subnetted
1
subnets

O 1.1.1.1 [110/65] via 172.12.123.1
0
Serial0

172.12.0.0/24 is subnetted
2
subnets

C 172.12.12.0 is directly connected
BRI0

C 172.12.123.0 is directly connected
Serial0

A floating static route is an excellent "back door" that will keep the ISDN link down while allowing that link to serve as a backup route. Just make sure the ISDN link comes down when you expect it to - always check that with show isdn status!

Planning for success on the CCNA
CCNP
and other Cisco exams is much like taking a trip in your car. You've got to plan ahead
accept the occasional detour
and just keep on going until you get there. But what do you do before you get started?

Create a road map - for success.

If you were driving from one side of the country to another
you certainly wouldn't just get in your car and start driving
would you? No. You would plan the trip out ahead of time. What would happen if you just got in the car and started driving in the hope that you would someday arrive at your final destination? You would never get there
and you'd spend a lot of time wandering aimlessly.

Don't spend your study time and slow your progress by studying for a Cisco exam without planning the trip. Schedule your study time as you would an appointment with a client
and keep that appointment. Make sure that your study time is quality study - turn your TV
iPod
and cell off. If you hit a bump in the road and don't get your certification the first time you take the exam
regroup and create another plan. Study until you get to the point that on exam day
you know that you are already a CCNA or CCNP and you’re just there at the testing center to make it official.

The journey to success is not a straight line. When you look at a chart that shows a company's financial progress
the line never goes straight up. there are some ups and downs
but the overall result is success. The path to your eventual career and certification exam success may not be a direct one
but the important part is to get started - and to get any journey started
you've got to create a road map for a successful arrival at your destination.

Passing the BSCI exam and earning your CCNP is all about knowing the details
and when it comes to EIGRP SIA routes
there are plenty of details to know. A quick check in a search engine for "troubleshoot SIA" will bring up quite a few matches. Troubleshooting SIA routes is very challengin in that there's no one reason they occur.

View the EIGRP topology table with the show ip eigrp topology command
and you'll see a code next to every successor and feasible successor. A popular misconception is that we want these routes to have an "A" next to them - so they're active. That's what we want
right? Active routes sound good
right?

Well
they sound good
but they're not. If a route shows as Active in the EIGRP topology table
that means that DUAL is currently calculating that route
and it's currently unusable. When a route is Passive ("P)
that means it's not being recalculated and it's a usable route.

Generally
a route shown as Active is going to be there for a very short period of time by the time you repeat the command
hopefully that Active route has gone Passive. Sometimes that doesn't happen
though
and the route becomes SIA - Stuck In Active.

A route becomes SIA when a query goes unanswered for so long that the neighbor relationship is reset. From experience
I can tell you that troubleshooting SIA routes is more of an art form than a science
but there are four main reasons a route becomes SIA:

The link is unidirectional
so the query can't possibly be answered.

The queried router's resources are unavailable
generally due to high CPU utilization.

The queried router's memory is corrupt or otherwise unable to allow the router to answer the query.

The link between the two routers is of low quality
allowing just enough packets through to keep the neighbor relationship intact
but not good enough to allow the replies through.

To sum it up
routes generally become SIA when a neighbor either doesn't answer a query
or either the query or reply took a wrong turn somewhere. I told you it wasn't the easiest thing to troubleshoot!

To earn your CCNP certification and pass the BCMSN exam
you've got to know what HSRP does and the many configurable options. While the operation of HSRP is quite simple (and covered in a previous tutorial)
you also need to know how HSRP arrives at the MAC address for the virtual router - as well as how to configure a new MAC for this virtual router. This puts us in the unusual position of creating a physical address for a router that doesn't exist!

The output of show standby for a two-router HSRP configuration is shown below.

R2#show standby

Ethernet0 - Group 5

Local state is Standby
priority 100

Hellotime 3 sec
holdtime 10 sec

Next hello sent in 0.776

Virtual IP address is 172.12.23.10 configured

Active router is 172.12.23.3
priority 100 expires in 9.568

Standby router is local

1 state changes
last state change 00:00:22

R3#show standby

Ethernet0 - Group 5

Local state is Active
priority 100

Hellotime 3 sec
holdtime 10 sec

Next hello sent in 2.592

Virtual IP address is 172.12.23.10 configured

Active router is local

Standby router is 172.12.23.2 expires in 8.020

Virtual mac address is 0000.0c07.ac05

2 state changes
last state change 00:02:08

R3 is in Active state
while R2 is in Standby. The hosts are using the 172.12.123.10 address as their gateway
but R3 is actually handling the workload. R2 will take over if R3 becomes unavailable.

An IP address was assigned to the virtual router during the HSRP configuration process
but not a MAC address. However
there is a MAC address under the show standby output on R3
the active router. How did the HSRP process arrive at a MAC of 00-00-0c-07-ac-05?

Well
most of the work is already done before the configuration is even begun. The MAC address 00-00-0c-07-ac-xx is reserved for HSRP
and xx is the group number in hexadecimal. That's a good skill to have for the exam
so make sure you're comfortable with hex conversions. The group number is 5
which is expressed as 05 with a two-bit hex character. If the group number had been 17
we'd see 11 at the end of the MAC address - one unit of 16
one unit of 1.

The output of the show standby command also tells us that the HSRP speakers are sending Hellos every 3 seconds
with a 10-second holdtime. These values can be changed with the standby command
but HSRP speakers in the same group should have the same timers. You can even tie down the hello time to the millisecond
but it's doubtful you'll ever need to do that.

R3(config-if)#standby 5 timers ?

<1-254> Hello interval in seconds

msec Specify hello interval in milliseconds

R3(config-if)#standby 5 timers 4 ?

<5-255> Hold time in seconds

R3(config-if)#standby 5 timers 4 12

Another important HSRP skill is knowing how to change the Active router assignment. I'll show you how to do that
and how to configure HSRP interface tracking
in the next part of my CCNP / BCMSN exam tutorial!

Defined in RFC 2281
HSRP is a Cisco-proprietary protocol in which routers are put into an HSRP router group. Along with dynamic routing protocols and STP
HSRP is considered a high-availability network service
since all three have an almost immediate cutover to a secondary path when the primary path is unavailable.

One of the routers will be selected as the primary ("Active"
in HSRP terminology)
and that primary will handle the routing while the other routers are in standby
ready to handle the load if the primary router becomes unavailable. In this fashion
HSRP ensures a high network uptime
since it routes IP traffic without relying on a single router.

The hosts using HSRP as a gateway don't know the actual IP or MAC addresses of the routers in the group. They're communicating with a pseudorouter
a "virtual router" created by the HSRP configuration. This virtual router will have a virtual MAC and IP adddress as well.

The standby routers aren't just going to be sitting there
though! By configuring multiple HSRP groups on a single interface
HSRP load balancing can be achieved.

Before we get to the more advanced HSRP configuration
we better get a basic one started! We'll be using a two-router topology here
and keep in mind that one or both of these routers could be multilayer switches as well. For ease of reading
I'm going to refer to them only as routers.

R2 and R3 will both be configured to be in standby group 5. The virtual router will have an IP address of 172.12.23.10 /24. All hosts in VLAN 100 should use this address as their default gateway.

R2(config)#interface ethernet0

R2(config-if)#standby 5 ip 172.12.23.10

R3(config)#interface ethernet0

R3(config-if)#standby 5 ip 172.12.23.10

The show command for HSRP is show standby
and it's the first command you should run while configuring and troubleshooting HSRP. Let's run it on both routers and compare results.

R2#show standby

Ethernet0 - Group 5

Local state is Standby
priority 100

Hellotime 3 sec
holdtime 10 sec

Next hello sent in 0.776

Virtual IP address is 172.12.23.10 configured

Active router is 172.12.23.3
priority 100 expires in 9.568

Standby router is local

1 state changes
last state change 00:00:22

R3#show standby

Ethernet0 - Group 5

Local state is Active
priority 100

Hellotime 3 sec
holdtime 10 sec

Next hello sent in 2.592

Virtual IP address is 172.12.23.10 configured

Active router is local

Standby router is 172.12.23.2 expires in 8.020

Virtual mac address is 0000.0c07.ac05

2 state changes
last state change 00:02:08

We can see that R3 has been selected as the Active router ("local state is Active")
the virtual router's IP is 172.12.23.10
and R2 is the standby router.

There are some HSRP values that you'll need to change from time to time. What if we want R2 to be the Active router instead? Can we change the MAC address of the virtual router? I'll answer those questions in the next part of this HSRP tutorial!

Passing the BCMSN exam and getting one step closer to the CCNP certification means learning and noticing details that you were not presented with in your CCNA studies. (Yes
I know – you had more than enough details then
right?) One protocol you’ve got to learn more details about is VTP
which seemed simple enough in your CCNA studies! Part of learning the details is mastering the fundamentals
so in this tutorial we’ll review the basics of VTP.


In show vtp status readouts
the "VTP Operating Mode" is set to "Server" by default. The more familiar term for VTP Operating Mode is simply VTP Mode
and Server is the default. It's through the usage of VTP modes that we can place limits on which switches can delete and create VLANs.

In Server mode
a VTP switch can be used to create
modify
and delete VLANs. This means that a VTP deployment has to have at least one switch in Server mode
or VLAN creation will not be possible. Again
this is the default setting for Cisco switches.

Switches running in Client mode cannot be used to create
modify
or delete VLANs. Clients do listen for VTP advertisements and act accordingly when VTP advertisements notify the Client of VLAN changes.

VTP Transparent mode actually means that the switch isn't participating in the VTP domain as Servers and Clients do. (Bear with me here.) Transparent VTP switches don't synchronize their VTP databases with other VTP speakers. They don't even advertise their own VLAN information! Therefore
any VLANs created on a Transparent VTP switch will not be advertised to other VTP speakers in the domain
making them locally significant only. (I know you remember that phrase from your CCNA studies!)

Devices running VTP Transparent mode do have a little something to do with the other switches in the VTP domain
though. When a switch running in Transparent mode receives a VTP advertisement
that switch will forward that advertisement to other switches in that VTP domain.

Configuring switches as VTP Clients is a great way to “tie down” VLAN creation capabilities to switches that are under your physical control. However
this occasionally leads to a situation where only the VTP clients will have ports that belong to a given VLAN
but the VLAN still has to be created on the VTP server. (VLANs can be created and deleted in transparent mode
but those changes aren't advertised to other switches in the VTP domain.)


In the next BCMSN tutorial
we’ll take a look at the details of VTP.

To pass the CCNA exam and earn this important certification
you’ve got to know switching inside and out. While you’re learning all the basic switching theory
make sure to spend some time with the one of three switching modes Cisco routers can use.

Store-and-Forward is exactly what it sounds like. The entire frame will be stored before it is forwarded. This mode allows for the greatest amount of error checking
since a CRC (Cyclical Redundancy Check) is run against the frame before it is forwarded. If the frame contains an error
it is discarded. If there’s no problem with the frame
the frame is then forwarded to its proper destination.


While store-and-forward does perform error checking
the delay in processing the frame while this error check is run results in higher latency than the other modes you’re about to read about. The latency time can also vary
since not all frames are the same size.

Cut-through switching copies only the destination MAC address into its memory before beginning to forward the frame. Since the frame is being forwarded as soon as the destination MAC is read
there is less latency than store-and-forward. The drawback is that there is no error checking.

There is a middle ground
fragment-free switching. Only part of the frame is copied to memory before it is forwarded
but it’s the first 64 bytes of the frame
not just the destination MAC. (Why? Because if there is a problem with the frame
it’s most likely in the first 64 bytes.) There is a little more error checking than cut-through
but not as much latency as with store-and-forward.

Note that the latency of both cut-through and fragment-free is fixed; these modes always look at the first six or 64 bytes
respectively. Store-and-forward's latency depends on the size of the frame.
Learning the similarities and differences between these modes is an often-overlooked part of CCNA studies. Spend some time studying this important CCNA topic – you’ll be glad you did!

CCNA and CCNP candidates who have their own Cisco home labs often email me about an odd situation that occurs when they erase a switch's configuration. Their startup configuration is gone
as they expect
but the VLAN and VTP information is still there!

Sounds strange
doesn't it? Let's look at an example. On SW1
we run show vlan brief and see in this abbreviated output that there are three additional vlans in use:

SW1#show vlan br


10 VLAN0010 active

20 VLAN0020 active

30 VLAN0030 active

We want to totally erase the router's startup configuration
so we use the write erase command
confirm it
and reload without saving the running config:

SW1#write erase

Erasing the nvram filesystem will remove all configuration files! Continue?

[confirm]

[OK]

Erase of nvram: complete


00:06:00: %SYS-7-NV_BLOCK_INIT: Initalized the geometry of nvram

SW1#reload

System configuration has been modified. Save? [yes/no]: n

Proceed with reload? [confirm]

The router reloads
and after exiting setup mode
we run show vlan brief again. And even though the startup configuration was erased
the vlans are still there!

Switch#show vlan br


10 VLAN0010 active

20 VLAN0020 active

30 VLAN0030 active

The reason is that this vlan and VTP information is actually kept in the VLAN.DAT file in Flash memory
and the contents of Flash are kept on a reload. The file has to be deleted manually.

There's a little trick to deleting this file. The switch will prompt you twice to ask if you really want to get rid of this file. Don't type "y" or "yes"; just accept the defaults by hitting the return key. If you type "y"
the router attempts to delete a file named "y"
as shown here:

Switch#delete vlan.dat

Delete filename [vlan.dat]? y

Delete flash:y? [confirm]

%Error deleting flash:y (No such file or directory)



Switch#delete vlan.dat

Delete filename [vlan.dat]?

Delete flash:vlan.dat? [confirm]


Switch#

The best way to prepare for CCNA and CCNP exam success is by working on real Cisco equipment
and by performing lab tasks over and over. Repetition is the mother of skill
and by truly erasing your VLAN and VTP information by deleting the vlan.dat file from Flash
you'll be building your Cisco skills to the point where your CCNA and CCNP exam success is a certainty.