Basic Switch Concept w.lilakiatsakun. IEEE802.3 (1) Carrier Sense (CS) Carrier Sense (CS) –In the...

Basic Switch ConceptBasic Switch Concept

w.lilakiatsakunw.lilakiatsakun

IEEE802.3 (1)IEEE802.3 (1)

• Carrier Sense (CS)Carrier Sense (CS)– In the CSMA/CD access method, all network In the CSMA/CD access method, all network

devices that have messages to send must devices that have messages to send must listen before transmittinglisten before transmitting. .

– If a device detects a signal from another If a device detects a signal from another device, device, it waits for a specified amount of timeit waits for a specified amount of time before attempting to transmit. before attempting to transmit.

– When When there is no traffic detected, a device there is no traffic detected, a device transmits its messagetransmits its message. . • While this transmission is occurring, the device While this transmission is occurring, the device

continues to listen for traffic or collisions on the LAN. continues to listen for traffic or collisions on the LAN. • After the message is sent, the device returns to its After the message is sent, the device returns to its

default listening mode. default listening mode.

IEEE802.3 (2)IEEE802.3 (2)

• Multiple Access (MA)Multiple Access (MA)– More than one devices can access on the same mediumMore than one devices can access on the same medium– This situation might cause data collisionThis situation might cause data collision

• Collision Detection (CD)Collision Detection (CD)– A device can detect when a collision occurs on the A device can detect when a collision occurs on the

shared media, because an increase in shared media, because an increase in the amplitude of the amplitude of the signal above the normal levelthe signal above the normal level..

– When a collision is detected, the transmitting devices When a collision is detected, the transmitting devices send out a send out a jamming signaljamming signal. .

– The jamming signal notifies the other devices of a The jamming signal notifies the other devices of a collision, so that they invoke a backoff algorithm. collision, so that they invoke a backoff algorithm.

– This backoff algorithm causes all devices to stop This backoff algorithm causes all devices to stop transmitting for a random amount of time, which allows transmitting for a random amount of time, which allows the collision signals to subside. the collision signals to subside.

Ethernet Communication (1)Ethernet Communication (1)

• UnicastUnicast– Communication in which a frame is sent from one Communication in which a frame is sent from one

host and addressed to one specific destination. host and addressed to one specific destination. – In unicast transmission, there is just In unicast transmission, there is just one sender one sender

and one receiver. and one receiver. – Unicast transmission is the predominant formUnicast transmission is the predominant form of of

transmission on LANs and within the Internet.transmission on LANs and within the Internet.– Examples of unicast transmissions include HTTP, Examples of unicast transmissions include HTTP,

SMTP, FTP, and Telnet.SMTP, FTP, and Telnet.


• BroadcastBroadcast– Communication in which a frame is sent Communication in which a frame is sent from from

one address to all other addressesone address to all other addresses..– In this case, there is just In this case, there is just one senderone sender, but the , but the

information is sent to information is sent to all connected receiversall connected receivers. . – Broadcast transmission is essential when Broadcast transmission is essential when

sending the same message to all devices on the sending the same message to all devices on the LAN.LAN.• An example of a broadcast transmission is the address An example of a broadcast transmission is the address

resolution query that the address resolution protocol resolution query that the address resolution protocol (ARP) sends to all computers on a LAN.(ARP) sends to all computers on a LAN.


• MulticastMulticast– Communication in which a frame is sent to Communication in which a frame is sent to

a specific a specific group of devices or clientsgroup of devices or clients. . – Multicast transmission clients must be Multicast transmission clients must be

members of a logical multicast groupmembers of a logical multicast group to to receive the information. receive the information. •An example of multicast transmission is the An example of multicast transmission is the

video and voice transmissions associated with video and voice transmissions associated with a network-based, collaborative business a network-based, collaborative business meeting.meeting.

MAC Address (1)MAC Address (1)

• Organizational Unique IdentifierOrganizational Unique Identifier– It is 24 bits long and identifies the manufacturer of It is 24 bits long and identifies the manufacturer of

the NIC card. the NIC card. – The IEEE regulates the assignment of OUI numbers. The IEEE regulates the assignment of OUI numbers. – Within the OUI, there are 2 bits that have meaning Within the OUI, there are 2 bits that have meaning

only when used in the destination address, as only when used in the destination address, as follows:follows:• Broadcast or multicast bitBroadcast or multicast bit: Indicates to the receiving : Indicates to the receiving

interface that the frame is destined for all or a group of interface that the frame is destined for all or a group of end stations on the LAN segment.end stations on the LAN segment.

• Locally administered address bitLocally administered address bit: If the vendor-assigned : If the vendor-assigned MAC address can be modified locally, this bit should be MAC address can be modified locally, this bit should be set.set.

MAC Address (2)MAC Address (2)

• Vendor Assignment NumberVendor Assignment Number– The vendor-assigned part of the MAC The vendor-assigned part of the MAC

address is 24 bits long and uniquely address is 24 bits long and uniquely identifies the Ethernet hardware. identifies the Ethernet hardware.

– It can be a BIA (Burned in Address) or It can be a BIA (Burned in Address) or modified by software indicated by the modified by software indicated by the local bit.local bit.

Duplex SettingDuplex Setting

MAC Address Table (1)MAC Address Table (1)


Frame are broadcasted to all ports since S1 does not haveMAC table for the destination


Frame is forwarded to port 1

Design Consideration Design Consideration

• Bandwidth and throughputBandwidth and throughput

• Collision DomainCollision Domain

• Broadcast DomainBroadcast Domain

• Network LatencyNetwork Latency

• Network CongestionNetwork Congestion

Bandwidth and throughputBandwidth and throughput

• It is important to understand that when It is important to understand that when stating the stating the bandwidth of the Ethernet bandwidth of the Ethernet network is 10 Mb/s, full bandwidth for network is 10 Mb/s, full bandwidth for transmission is available only after any transmission is available only after any collisions have been resolvedcollisions have been resolved. .

• The net throughput of the port (the average The net throughput of the port (the average data that is effectively transmitted) will be data that is effectively transmitted) will be considerably reduced as a function of how considerably reduced as a function of how many other nodes want to use the network. many other nodes want to use the network.

• As a result, As a result, the number of nodes sharing the the number of nodes sharing the Ethernet network will have effect on the Ethernet network will have effect on the throughput or productivity of the networkthroughput or productivity of the network..

Collision Domain (1)Collision Domain (1)

• The network area where frames originate and The network area where frames originate and collide is called the collision domain. collide is called the collision domain.

• All shared media environments, such as All shared media environments, such as those created by using hubs, are collision those created by using hubs, are collision domainsdomains. .

• When a host is connected to a switch port, When a host is connected to a switch port, the switch creates the switch creates a dedicated connectiona dedicated connection. . – This connection is considered an individual This connection is considered an individual

collision domain, because traffic is kept separate collision domain, because traffic is kept separate from all other traffic, thereby eliminating the from all other traffic, thereby eliminating the potential for a collision. potential for a collision.

Collision Domain (2)Collision Domain (2)

Broadcast Domain (1)Broadcast Domain (1)

• A collection of interconnected switches forms a A collection of interconnected switches forms a single broadcast domainsingle broadcast domain. .

• Only a Layer 3 entity, such as a router, or a Only a Layer 3 entity, such as a router, or a virtual LAN (VLAN), can stop a Layer 3 broadcast virtual LAN (VLAN), can stop a Layer 3 broadcast domain. domain.

• Routers and VLANs are used to segment both Routers and VLANs are used to segment both collision and broadcast domains. collision and broadcast domains.

• When a device wants to send out a Layer 2 When a device wants to send out a Layer 2 broadcast, the destination MAC address in the broadcast, the destination MAC address in the frame is set to all ones. frame is set to all ones. – By setting the destination to this value, all the devices By setting the destination to this value, all the devices

accept and process the broadcasted frame.accept and process the broadcasted frame.

Broadcast Domain (2)Broadcast Domain (2)

The broadcast domain at Layer 2 is referred to as the MAC broadcast domain. The MAC broadcast domain consists of all devices on the LAN that receive frame broadcasts by a host to all other machines on the LAN.

Network LatencyNetwork Latency

Network Congestion (1)Network Congestion (1)

• The primary reason for segmenting a The primary reason for segmenting a LAN into smaller parts is LAN into smaller parts is to isolate to isolate traffic and to achieve better use of traffic and to achieve better use of bandwidth per userbandwidth per user. .

• Without segmentation, a LAN quickly Without segmentation, a LAN quickly becomes clogged with traffic and becomes clogged with traffic and collisions. collisions.

Network Congestion (2)Network Congestion (2)

• These are the most common causes of These are the most common causes of network congestion:network congestion:– Increasingly powerful computer and network Increasingly powerful computer and network

technologiestechnologies. . • they can send more data at higher rates through the they can send more data at higher rates through the

network, and they can process more data at higher rates.network, and they can process more data at higher rates.– Increasing volume of network trafficIncreasing volume of network traffic. .

• In addition to normal traffic, broadcast messages, such In addition to normal traffic, broadcast messages, such as address resolution queries are also sent outas address resolution queries are also sent out

– High-bandwidth applicationsHigh-bandwidth applications • Desktop publishing, engineering design, video on Desktop publishing, engineering design, video on

demand (VoD), electronic learning (e-learning), and demand (VoD), electronic learning (e-learning), and streaming video all require considerable processing streaming video all require considerable processing power and speed.power and speed.

LAN Segmentation (1)LAN Segmentation (1)

Uncontrolled Collision Domain and Broadcast Domain


Uncontrolled Collision Domain and Broadcast Domain


Controlled Collision Domain and Broadcast Domain

Controlling Network LatencyControlling Network Latency

Switch Forwarding Method Switch Forwarding Method (1)(1)• Store and ForwardStore and Forward

– When the switch receives the frame, it stores When the switch receives the frame, it stores the data in buffers until the complete frame the data in buffers until the complete frame has been received.has been received.

– During the storage process, the switch During the storage process, the switch analyzes the frame for information about its analyzes the frame for information about its destination. destination.

– In this process, the switch also performs an In this process, the switch also performs an error check using the Cyclic Redundancy Check error check using the Cyclic Redundancy Check (CRC) trailer portion of the Ethernet frame. (CRC) trailer portion of the Ethernet frame.

Switch Forwarding Method Switch Forwarding Method (2)(2)• Cut ThroughCut Through

– Fast-forward switching: Fast-forward switching: •Fast-forward switching offers the lowest Fast-forward switching offers the lowest

level of latency. Fast-forward switching level of latency. Fast-forward switching immediately forwards a packet after reading immediately forwards a packet after reading the destination address. the destination address.

• In fast-forward mode, latency is measured In fast-forward mode, latency is measured from the first bit received to the first bit from the first bit received to the first bit transmitted. transmitted.

•Fast-forward switching is the typical cut-Fast-forward switching is the typical cut-through method of switching.through method of switching.

Switch Forwarding Method Switch Forwarding Method (3)(3)

– Fragment-free switching: Fragment-free switching: • The switch stores the first 64 bytes of the frame The switch stores the first 64 bytes of the frame

before forwarding. before forwarding.

• The reason fragment-free switching stores only the The reason fragment-free switching stores only the first 64 bytes of the frame is that most network errors first 64 bytes of the frame is that most network errors and collisions occur during the first 64 bytes.and collisions occur during the first 64 bytes.

• Fragment-free switching tries to enhance cut-through Fragment-free switching tries to enhance cut-through switching by performing a small error check on the switching by performing a small error check on the first 64 bytes of the frame to ensure that a collision first 64 bytes of the frame to ensure that a collision has not occurred before forwarding the frame. has not occurred before forwarding the frame.

Switch security (1)Switch security (1)

• MAC Address FloodingMAC Address Flooding– MAC address flooding is a common attack. MAC address flooding is a common attack. – When a Layer 2 switch receives a frame, the When a Layer 2 switch receives a frame, the

switch looks in the MAC address table for the switch looks in the MAC address table for the destination MAC address. destination MAC address.

– As frames arrive on switch ports, the source As frames arrive on switch ports, the source MAC addresses are learned and recorded in the MAC addresses are learned and recorded in the MAC address table. MAC address table.

– If an entry exists for the MAC address, the If an entry exists for the MAC address, the switch forwards the frame to the MAC address switch forwards the frame to the MAC address port designated in the MAC address table. port designated in the MAC address table.

– If the MAC address does not exist, the switch If the MAC address does not exist, the switch acts like a hub and forwards the frame out every acts like a hub and forwards the frame out every portport on the switch. on the switch.

Switch security (4)Switch security (4)

Basic Switch configurationBasic Switch configuration

W.lilakiatsakunW.lilakiatsakun

Boot sequence (1)Boot sequence (1)

• The switch loads the boot loader software. The The switch loads the boot loader software. The boot loader is a small program stored in boot loader is a small program stored in NVRAM and is run when the switch is first NVRAM and is run when the switch is first turned on.turned on.

• The boot loader:The boot loader:– Performs low-level CPU initialization. It initializes the Performs low-level CPU initialization. It initializes the

CPU registers, which control where physical memory CPU registers, which control where physical memory is mapped, the quantity of memory, and its speed. is mapped, the quantity of memory, and its speed.

– Performs power-on self-test (POST) for the CPU Performs power-on self-test (POST) for the CPU subsystem. It tests the CPU DRAM and the portion of subsystem. It tests the CPU DRAM and the portion of the flash device that makes up the flash file system. the flash device that makes up the flash file system.

Boot sequence (2)Boot sequence (2)

– Initializes the flash file system on the system board. Initializes the flash file system on the system board. – Loads a default operating system software image into Loads a default operating system software image into

memory and boots the switch. The boot loader finds memory and boots the switch. The boot loader finds the Cisco IOS image on the switch by first looking in a the Cisco IOS image on the switch by first looking in a directory that has the same name as the image file directory that has the same name as the image file (excluding the .bin extension). (excluding the .bin extension). • If it does not find it there, the boot loader software searches If it does not find it there, the boot loader software searches

each subdirectory before continuing the search in the original each subdirectory before continuing the search in the original directory.directory.

• The operating system then initializes the The operating system then initializes the interfaces using the Cisco IOS commands found interfaces using the Cisco IOS commands found in the operating system configuration file, in the operating system configuration file, config.text, stored in the switch flash memory.config.text, stored in the switch flash memory.

Managing interfaces (1)Managing interfaces (1)• An access layer switch is much like a PC in that you An access layer switch is much like a PC in that you

need to configure an IP address, a subnet mask, and a need to configure an IP address, a subnet mask, and a default gateway. default gateway.

• To manage a switch remotely using TCP/IP, you need To manage a switch remotely using TCP/IP, you need to assign the switch an IP address. to assign the switch an IP address.

• In the figure, you want to manage S1 from PC1, a In the figure, you want to manage S1 from PC1, a computer used for managing the network. To do this, computer used for managing the network. To do this, you need to assign switch S1 an IP address. you need to assign switch S1 an IP address. – This IP address is assigned to a virtual interface called a This IP address is assigned to a virtual interface called a

virtual LAN (VLAN), and then it is necessary to ensure the virtual LAN (VLAN), and then it is necessary to ensure the VLAN is assigned to a specific port or ports on the switch. VLAN is assigned to a specific port or ports on the switch.

• The default configuration on the switch is to have the The default configuration on the switch is to have the management of the switch controlled through VLAN 1. management of the switch controlled through VLAN 1. However, a best practice for basic switch However, a best practice for basic switch configuration is to change the management VLAN to a configuration is to change the management VLAN to a VLAN other than VLAN 1. VLAN other than VLAN 1.

Managing interfaces (2)Managing interfaces (2)


• Use the Use the show ip interface briefshow ip interface brief to verify port operation and to verify port operation and status.status.

• The The mdix automdix auto Command Command

• When the auto-MDIX feature is enabled, the switch detects When the auto-MDIX feature is enabled, the switch detects the required cable type for copper Ethernet connections and the required cable type for copper Ethernet connections and configures the interfaces accordingly. configures the interfaces accordingly. – Therefore, you can use either a crossover or a straight-through Therefore, you can use either a crossover or a straight-through

cable for connections to a copper 10/100/1000 port on the cable for connections to a copper 10/100/1000 port on the switch, regardless of the type of device on the other end of the switch, regardless of the type of device on the other end of the connection.connection.

• The auto-MDIX feature is enabled by default on switches The auto-MDIX feature is enabled by default on switches running Cisco IOS Release 12.2(18)SE or later. For releases running Cisco IOS Release 12.2(18)SE or later. For releases between Cisco IOS Release 12.1(14)EA1 and 12.2(18)SE, the between Cisco IOS Release 12.1(14)EA1 and 12.2(18)SE, the auto-MDIX feature is disabled by default.auto-MDIX feature is disabled by default.


• Configure Duplex and SpeedConfigure Duplex and Speed• You can use theYou can use the duplex duplex interface interface

configuration command to specify the configuration command to specify the duplex mode of operation for switch ports. duplex mode of operation for switch ports.

• You can manually set the duplex mode and You can manually set the duplex mode and speed of switch ports to avoid inter-vendor speed of switch ports to avoid inter-vendor issues with autonegotiation. issues with autonegotiation.

• Although there can be issues when you Although there can be issues when you configure switch port duplex settings to configure switch port duplex settings to auto, in this example, S1 and S2 switches auto, in this example, S1 and S2 switches have the same duplex settings and speeds. have the same duplex settings and speeds.

Managing MAC Address Managing MAC Address Table(1)Table(1)• Switches use MAC address tables to determine Switches use MAC address tables to determine

how to forward traffic between ports. how to forward traffic between ports. – These MAC tables include dynamic and static addresses. These MAC tables include dynamic and static addresses.

• Dynamic addressesDynamic addresses are source MAC addresses are source MAC addresses that the switch learns and then ages when they that the switch learns and then ages when they are not in use. are not in use.

• You can change the aging time setting for MAC You can change the aging time setting for MAC addresses. addresses. – The default time is 300 seconds. The default time is 300 seconds. – Setting too short an aging time can cause addresses to Setting too short an aging time can cause addresses to

be prematurely removed from the table. be prematurely removed from the table. – Setting too long an aging time can cause the address Setting too long an aging time can cause the address

table to be filled with unused addresses, which prevents table to be filled with unused addresses, which prevents new addresses from being learned. new addresses from being learned.

Managing MAC Address Managing MAC Address Table(2)Table(2)• The switch provides dynamic addressing by The switch provides dynamic addressing by

learning the source MAC address of each learning the source MAC address of each frame that it receives on each port.frame that it receives on each port.

• Then switch adds the source MAC address Then switch adds the source MAC address and its associated port number to the MAC and its associated port number to the MAC address table. address table.

• As computers are added or removed from As computers are added or removed from the network, the switch updates the MAC the network, the switch updates the MAC address table, adding new entries and aging address table, adding new entries and aging out those that are currently not in use.out those that are currently not in use.

Managing MAC Address Managing MAC Address Table(3)Table(3)• A network administrator can specifically assign A network administrator can specifically assign

static MAC addresses to certain ports. static MAC addresses to certain ports. • Static addressesStatic addresses are not aged out, and the are not aged out, and the

switch always knows which port to send out switch always knows which port to send out traffic destined for that specific MAC address.traffic destined for that specific MAC address.

• As a result, there is no need to relearn or As a result, there is no need to relearn or refresh which port the MAC address is refresh which port the MAC address is connected to. connected to.

• One reason to implement static MAC addresses One reason to implement static MAC addresses is to provide the network administrator is to provide the network administrator complete control over access to the networkcomplete control over access to the network..– Only those devices that are known to the network Only those devices that are known to the network

administrator can connect to the network.administrator can connect to the network.

Managing MAC Address Managing MAC Address Table(4)Table(4)• To create a static mapping in the MAC address To create a static mapping in the MAC address

table, use the table, use the – mac-address-table static <MAC address> vlan {1-4096, mac-address-table static <MAC address> vlan {1-4096,

ALL} interfaceinterface-idALL} interfaceinterface-id

• To remove a static mapping in the MAC address To remove a static mapping in the MAC address table, use the table, use the – no mac-address-table static <MAC address> vlan {1-no mac-address-table static <MAC address> vlan {1-

4096, ALL} interfaceinterface-id4096, ALL} interfaceinterface-id

• The maximum size of the MAC address table The maximum size of the MAC address table varies with different switches. varies with different switches. – For example, the Catalyst 2960 series switch can store up For example, the Catalyst 2960 series switch can store up

to 8,192 MAC addresses. to 8,192 MAC addresses. – There are other protocols that may limit the absolute There are other protocols that may limit the absolute

number of MAC address available to a switch.number of MAC address available to a switch.

Verifying switch Verifying switch configurationconfiguration

Backup and Restore switch Backup and Restore switch configurationsconfigurations

Backup to TFTP serverBackup to TFTP server

• Step 1. Verify that the TFTP server is running on your Step 1. Verify that the TFTP server is running on your network.network.

• Step 2. Log in to the switch through the console port or a Step 2. Log in to the switch through the console port or a Telnet session. Enable the switch and then ping the TFTP Telnet session. Enable the switch and then ping the TFTP server.server.

• Step 3. Upload the switch configuration to the TFTP server. Step 3. Upload the switch configuration to the TFTP server. Specify the IP address or hostname of the TFTP server and Specify the IP address or hostname of the TFTP server and the destination filename. The Cisco IOS command is: the destination filename. The Cisco IOS command is:

#copy system:running-config #copy system:running-config tftp:[[[//location]/directory]/filename] tftp:[[[//location]/directory]/filename] #copy nvram:startup-config #copy nvram:startup-config tftp:[[[//location]/directory]/filename].tftp:[[[//location]/directory]/filename].

Restore from TFTP serverRestore from TFTP server

• Step 1. Copy the configuration file to the appropriate TFTP Step 1. Copy the configuration file to the appropriate TFTP directory on the TFTP server if it is not already there.directory on the TFTP server if it is not already there.

• Step 2. Verify that the TFTP server is running on your Step 2. Verify that the TFTP server is running on your network.network.

• Step 3. Log in to the switch through the console port or a Step 3. Log in to the switch through the console port or a Telnet session. Enable the switch and then ping the TFTP Telnet session. Enable the switch and then ping the TFTP server.server.

• Step 4. Download the configuration file from the TFTP server Step 4. Download the configuration file from the TFTP server to configure the switch. Specify the IP address or hostname of to configure the switch. Specify the IP address or hostname of the TFTP server and the name of the file to download. The the TFTP server and the name of the file to download. The Cisco IOS command is: Cisco IOS command is: #copy tftp:[[[//location]/directory]/filename] system:running-#copy tftp:[[[//location]/directory]/filename] system:running-config or #copy tftp:[[[//location]/directory]/filename] config or #copy tftp:[[[//location]/directory]/filename] nvram:startup-config.nvram:startup-config.

Clearing Configuration Clearing Configuration Information Information • You can clear the configuration information from You can clear the configuration information from

the startup configuration. the startup configuration. • To clear the contents of your startup configuration, To clear the contents of your startup configuration,

use the use the – erase nvram: erase nvram: – erase startup-configerase startup-config

Configure Console PasswordConfigure Console Password

Configure Virtual Terminal Configure Virtual Terminal AccessAccess

Configure EXEC Mode Configure EXEC Mode PasswordPassword

Password Recovery steps Password Recovery steps (1)(1)• Step 1. Connect a terminal or PC with terminal-emulation Step 1. Connect a terminal or PC with terminal-emulation

software to the switch console port.software to the switch console port.• Step 2. Set the line speed on the emulation software to 9600 Step 2. Set the line speed on the emulation software to 9600

baud.baud.• Step 3. Power off the switch. Reconnect the power cord to Step 3. Power off the switch. Reconnect the power cord to

the switch and within 15 seconds, press the Mode button the switch and within 15 seconds, press the Mode button while the System LED is still flashing green. Continue while the System LED is still flashing green. Continue pressing the Mode button until the System LED turns briefly pressing the Mode button until the System LED turns briefly amber and then solid green. Then release the Mode button.amber and then solid green. Then release the Mode button.

• Step 4. Initialize the Flash file system using the flash_init Step 4. Initialize the Flash file system using the flash_init command.command.

• Step 5. Load any helper files using the load_helper Step 5. Load any helper files using the load_helper command.command.

• Step 6. Display the contents of Flash memory using the dir Step 6. Display the contents of Flash memory using the dir flash command:flash command:

Directory of flash:Directory of flash:13 drwx 192 Mar 01 1993 22:30:48 c2960-lanbase-mz.122-25.FX13 drwx 192 Mar 01 1993 22:30:48 c2960-lanbase-mz.122-25.FX11 -rwx 5825 Mar 01 1993 22:31:59 config.text11 -rwx 5825 Mar 01 1993 22:31:59 config.text18 -rwx 720 Mar 01 1993 02:21:30 vlan.dat18 -rwx 720 Mar 01 1993 02:21:30 vlan.dat16128000 bytes total (10003456 bytes free)16128000 bytes total (10003456 bytes free)

Password Recovery steps Password Recovery steps (2)(2)• Step 7. Rename the configuration file to Step 7. Rename the configuration file to

config.text.old, which contains the password config.text.old, which contains the password definition, using the definition, using the rename flash:config.text rename flash:config.text flash:config.text.oldflash:config.text.old command. command.

• Step 8. Boot the system with the Step 8. Boot the system with the bootboot command. command. • Step 9. You are prompted to start the setup Step 9. You are prompted to start the setup

program. program. – Enter N at the prompt, and then when the system prompts Enter N at the prompt, and then when the system prompts

whether to continue with the configuration dialog, enter N.whether to continue with the configuration dialog, enter N.

• Step 10. At the switch prompt, enter privileged Step 10. At the switch prompt, enter privileged EXEC mode using the enable command.EXEC mode using the enable command.

• Step 11. Rename the configuration file to its original Step 11. Rename the configuration file to its original name using the name using the rename flash:config.text.old rename flash:config.text.old flash:config.textflash:config.text command. command.

Password Recovery steps Password Recovery steps (3)(3)• Step 12. Copy the configuration file into memory Step 12. Copy the configuration file into memory

using the using the copy flash:config.text system:running-copy flash:config.text system:running-configconfig command. After this command has been command. After this command has been entered, the follow is displayed on the console:entered, the follow is displayed on the console:

Source filename [config.text]? Source filename [config.text]? Destination filename [running-config]?Destination filename [running-config]?

• Press Return in response to the confirmation Press Return in response to the confirmation prompts. The configuration file is now reloaded, prompts. The configuration file is now reloaded, and you can change the password.and you can change the password.

• Step 13. Enter global configuration mode using the Step 13. Enter global configuration mode using the configure terminalconfigure terminal command. command.

Password Recovery steps Password Recovery steps (4)(4)• Step 14. Change the password using the Step 14. Change the password using the enable enable

secretpasswordsecretpassword command. command.

• Step 15. Return to privileged EXEC mode using the Step 15. Return to privileged EXEC mode using the exitexit command. command.

• Step 16. Write the running configuration to the Step 16. Write the running configuration to the startup configuration file using the startup configuration file using the copy running-copy running-config startup-configconfig startup-config command. command.

• Step 17. Reload the switch using the Step 17. Reload the switch using the reloadreload command.command.

Configure Login & MOTD Configure Login & MOTD BannerBanner

Configuring Telnet Configuring Telnet

• Telnet is the default vty-supported protocol Telnet is the default vty-supported protocol on a Cisco switch. on a Cisco switch.

• Initially, the vty lines are unsecured Initially, the vty lines are unsecured allowing access by any user attempting to allowing access by any user attempting to connect to themconnect to them

Configuring Port security (1)Configuring Port security (1)

• Secure MAC Address TypesSecure MAC Address Types

• Static secure MAC addressesStatic secure MAC addresses: MAC addresses are manually : MAC addresses are manually configured by using the configured by using the switchport port-security mac-switchport port-security mac-addressmac-addressaddressmac-address interface configuration command. interface configuration command. – MAC addresses configured in this way are stored in the address MAC addresses configured in this way are stored in the address

table and are added to the running configuration on the switch. table and are added to the running configuration on the switch.

• Dynamic secure MAC addressesDynamic secure MAC addresses: MAC addresses are : MAC addresses are dynamically learned and stored only in the address table. dynamically learned and stored only in the address table. – MAC addresses configured in this way are removed when the MAC addresses configured in this way are removed when the

switch restarts. switch restarts.

• Sticky secure MAC addressesSticky secure MAC addresses: You can configure a port to : You can configure a port to dynamically learn MAC addresses and then save these MAC dynamically learn MAC addresses and then save these MAC addresses to the running configuration. addresses to the running configuration.


• Sticky MAC AddressesSticky MAC Addresses

• When you enable sticky learning on an interface by using the When you enable sticky learning on an interface by using the switchport port-security mac-address stickyswitchport port-security mac-address sticky interface interface configuration command,configuration command,– the interface converts all the dynamic secure MAC addresses, the interface converts all the dynamic secure MAC addresses,

including those that were dynamically learned before sticky including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses and adds learning was enabled, to sticky secure MAC addresses and adds all sticky secure MAC addresses to the running configuration. all sticky secure MAC addresses to the running configuration.

• If you disable sticky learning by using the If you disable sticky learning by using the no switchport port-no switchport port-security mac-address stickysecurity mac-address sticky interface configuration command interface configuration command or the running configuration is removed, the sticky secure or the running configuration is removed, the sticky secure MAC addresses remain part of the running configuration but MAC addresses remain part of the running configuration but are removed from the address table. are removed from the address table. – The addresses that were removed can be dynamically The addresses that were removed can be dynamically

reconfigured and added to the address table as dynamic reconfigured and added to the address table as dynamic addresses. addresses.

Configuring Port security (3)Configuring Port security (3)• When you configure sticky secure MAC addresses When you configure sticky secure MAC addresses

by using the by using the switchport port-security mac-address switchport port-security mac-address sticky mac-addresssticky mac-address interface configuration interface configuration command, these addresses are added to the command, these addresses are added to the address table and the running configuration.address table and the running configuration.– If port security is disabled, the sticky secure MAC If port security is disabled, the sticky secure MAC

addresses remain in the running configuration. addresses remain in the running configuration.

• If you save the sticky secure MAC addresses in the If you save the sticky secure MAC addresses in the configuration file, when the switch restarts or the configuration file, when the switch restarts or the interface shuts down, the interface does not need to interface shuts down, the interface does not need to relearn these addresses.relearn these addresses.– If you do not save the sticky secure addresses, they are If you do not save the sticky secure addresses, they are

lost. If sticky learning is disabled, the sticky secure MAC lost. If sticky learning is disabled, the sticky secure MAC addresses are converted to dynamic secure addresses and addresses are converted to dynamic secure addresses and are removed from the running configuration. are removed from the running configuration.


• Security Violation ModesSecurity Violation Modes• The maximum number of secure MAC addresses have The maximum number of secure MAC addresses have

been added to the address table, and a station whose been added to the address table, and a station whose MAC address is not in the address table attempts to MAC address is not in the address table attempts to access the interface. access the interface.

• An address learned or configured on one secure An address learned or configured on one secure interface is seen on another secure interface in the interface is seen on another secure interface in the same VLAN.same VLAN.

• Violation modes are configured on a port: Violation modes are configured on a port: • protectprotect: When the number of secure MAC addresses : When the number of secure MAC addresses

reaches the limit allowed on the port, packets with reaches the limit allowed on the port, packets with unknown source addresses are unknown source addresses are droppeddropped until you until you remove a sufficient number of secure MAC addresses or remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. increase the number of maximum allowable addresses. You are not notified that a security violation has You are not notified that a security violation has occurredoccurred. .


• restrictrestrict: When the number of secure MAC addresses : When the number of secure MAC addresses reaches the limit allowed on the port, packets with reaches the limit allowed on the port, packets with unknown source addresses are unknown source addresses are droppeddropped until you until you remove a sufficient number of secure MAC addresses remove a sufficient number of secure MAC addresses or increase the number of maximum allowable or increase the number of maximum allowable addresses. In this mode, addresses. In this mode, you are notified that a you are notified that a security violation has occurred. Specifically, an SNMP security violation has occurred. Specifically, an SNMP trap is sent, a syslog message is logged, and the trap is sent, a syslog message is logged, and the violation counter increments. violation counter increments.

• shutdownshutdown: In this mode, a port security violation : In this mode, a port security violation causes the interface to immediately become causes the interface to immediately become error-error-disabled and turns off the port LEDdisabled and turns off the port LED. It also sends an . It also sends an SNMP trap, logs a syslog message, and increments the SNMP trap, logs a syslog message, and increments the violation counter. violation counter. – When a secure port is in the error-disabled state, you can bring When a secure port is in the error-disabled state, you can bring

it out of this state by entering the shutdown and no shutdown it out of this state by entering the shutdown and no shutdown interface configuration commands. This is the default mode.interface configuration commands. This is the default mode.

Configuring Port security Configuring Port security (10)(10)

Configuring Port security Configuring Port security (11)(11)

Configuring Port security Configuring Port security (12)(12)• Disable Unused PortsDisable Unused Ports

• A simple method many administrators use to help A simple method many administrators use to help secure their network from unauthorized access is secure their network from unauthorized access is to disable all unused ports on a network switch. to disable all unused ports on a network switch.

• It is simple to disable multiple ports on a switch. It is simple to disable multiple ports on a switch. Navigate to each unused port and issue this Cisco Navigate to each unused port and issue this Cisco IOS IOS shutdownshutdown command. command.

• An alternate way to shutdown multiple ports is to An alternate way to shutdown multiple ports is to use the use the interface rangeinterface range command. command. – If a port needs to be activated, you can manually enter If a port needs to be activated, you can manually enter

the no shutdown command on that interface.the no shutdown command on that interface.

Basic Switch Concept w.lilakiatsakun. IEEE802.3 (1) Carrier Sense (CS) Carrier Sense (CS) –In the...

Documents

Transcript of Basic Switch Concept w.lilakiatsakun. IEEE802.3 (1) Carrier Sense (CS) Carrier Sense (CS) –In the...