Cisco SONA

CiscoSONA介紹(1)

瞭解思科服務導向網路架構 (sona)

企業面臨的挑戰
儘管投入大量 it 資金,但許多企業發現大多數的關鍵網路資源和資訊資產仍處於遊離狀態。事實上,擁有數百個無法彼此通信的"孤立"應用和資料庫是常見的企業現象。

K造成此種現象的原因是由於內外部客戶不斷增長卻無法預測的需求所致。許多企業都被迫迅速部署新技術,常導致部署多個分立系統,進而無法在機構內有效地共用資訊。
例如,如果不建立將應用和資訊結合在一起的各種重疊網路,銷售人員、客戶服務人員或採購部門將無法輕鬆訪問客戶記錄。許多企業都發現,這種盲目擴展為他們帶來了多個未得到充分利用的、無法協調的 分離系統和資源。這些分離的系統同時還難以 管理 且管理成本高昂。

思科的SONA & IIN優勢

智慧資訊網路優勢

思科系統公司®憑藉智慧資訊網路 (iin) 計畫,正在幫助全球 it 機構解決這些問題並迎接新挑戰,如部署服務導向的架構、web服務和虛擬化等。 iin 詳細闡述了網路在促進軟硬體集成方面的發展,這將使機構能夠更好地根據業務優先順序來調整 it 資源。通過將智慧構建於現有網路基礎設施之中,iin 將幫助機構實現降低基礎設施複雜性和成本等優勢
網路的重要性.com/I]n+_+Z:H9m,YE
it 環境的創新主要集中在通過傳統的基於伺服器的系統來分發新業務應用。然而,網路仍然是透明連接並支持it 基礎 架構 的所有組件的平臺。
使用思科®服務導向網路架構 (sona) ,企業可優化應用、流程和資源,來獲得更大的商業利益 。通過提供更出色的網路功能和智慧,企業可提高與網路相關的各種活動的效率,同時 將更多的 資金用於全新的戰略投資和創新。
標準化降低了支持相同數量的資產所需的運營成本,進而提高了資產效率。虛擬化優化了資產的使用,可從邏輯上分割實際資源,以便在所有的分散部門中使用。整個網路效率的全面提高能夠增強靈活性及可擴展性,進而對業務發展、客戶忠誠度及利潤產生巨大影響 — 從而提高企業的競爭優勢。
利用架構取得成功

cisco  sona 架構闡述了企業應如何發展到智慧資訊網路,以便加速應用、業務流程和資源使用、並使 it 能夠為企業提供更好服務。
cisco sona 利用思科及思科合作夥伴在各行業的解決方案、服務和經驗來提供公認的、可擴展的商業解決方案。

cisco sona 架構闡述了如何在全面融合的智慧型網路上構建集成系統,以便大幅度提高靈活性和效率。

企業可將這種 綜合的 智慧特性部署在整個網路之中,包括資料中心、分支機搆和園區環境。

圖 1. 思科服務導向網路架構 NB Vista(Vista技術論壇) O        L K]W"a1V

&^1~­fD-PL#Y+q

\ 遠程工作人員n
           伺服器    存儲 O-I   用戶端:b2F        G(I,[2`%EZ
o n,?&tE
w;P2U(J
DY(@Hnhv$`
智慧資訊網路(IIN)N(B Vista(Vista技術論壇)A’Y(W"(A4I(

應用層     商業應用 4JR 協調統合應用

互動服務層服務     網路基礎設施虛擬化  基礎設施服務  自我調適的管理)k


網路基礎設施服務    園區  分支機搆 資料中

cisco  sona 的三個層次^

1. 網路基礎設施層,在此,所有的 it 資源在融合網路平臺上

2.交互服務層,為利用網路基礎設施的應用和業務流程有效分配資源

3.應用層,包含商業應用和協作應用,充分利用交互服務的效率在網路基礎設施層,經過驗證的思科企業
架構提供全面的設計指南,為你的全部網路提供全面的集成的端到端系統設計指南。在交互服務層,思科將全套服務集成到智慧系統中,以優化商業和協作應用的分發,從而提供可預測性更強、更可靠的性

能,同時降低運營成本。在應用層,通過與網路矩陣深入集成,思科應用網路解決方案無需安裝用戶端
或更改應用,同時在整個應用分發時保持應用可視性和 安全性。

;n~:P.w(ZO構建 cisco sona 的商業優勢,更簡單、更靈活的集成基礎設施將提供更高的靈活性和適應性,進而以更低成本實現更高的商業收益。使用 cisco sona ,您將能夠提高整體 it 效率和利用率,由此增強 it 的效能,我們稱之為網路乘法效應
網路放大效應
網路放大效應指通過 cisco sona 幫助企業 it 增強對整個企業的貢獻。 it 資源的最佳效率和使用將以更低成本對企業產生更高影響,使您的網路成為可盈利的增值資源
網路放大效應計算如下:   K.V
GZ-@Nz6KD

f.gh zC j
效率 = it 資產的成本 ÷ (it 資產的成本+運營成本 ) ;ksSi’l f
w*Wn2c
使用率 = 所使用的資產與總資產的百分比 (如正使用的可用存儲百分比) NB Vista(Vista技術論壇)WgMwf._(D
效能 = 效率 x 使用率
網路放大效應 = 使用 cisco sona 時的資產效能 ÷ 不使用 cisco sona 時的資產效能
投資收益 NB Vista(Vista技術論壇)C­D2XlCl`
cisco sona 中思科智慧系統的優勢不僅是提高效率和降低成本。通過 cisco sona ,您可通過網路的力量實現:

增加收入和機會
改進客戶關係
提高業務永續性和靈活性
提高生產率和效率並降低成本
即時發展
通過 cisco sona 朝著更智慧的集成網路發展,企業可分階段完成:融合、標準化、虛擬化和自動化。與思科管道夥伴或客戶團隊合作,您可使用 cisco sona 框架 為企業的發展制訂 藍圖 。憑藉思科生命週期管理服務、標準化領域的領先地位、成熟的企業架構和創建針對性行業解決方案的豐富經驗,思科客戶團隊可幫您即時滿足業務要求。

發展到智慧資訊網路
網路的作用正在不斷發展。明天的智慧型網路將 不止 提供基本的連接、用戶帶寬和應用訪問服務,它將提供端到端的功能和集中統一的 控制,實現真正的企業透明性和靈活性。 cisco sona 使企業能夠擴展其現有基礎設施,朝著智慧型網路發展,以加速應用並改進業務流程。思科提供設計、支援和融資服務,以便最大限度地提高您的投資回報。

思科生命週期服務與支援
思科及其合作夥伴提供了生命週期服務方法,以使客戶的業務目標與技術實施保持一致。此方法根據技術和 網路的 複雜性,定義了必須採取的措施,以幫您成功部署並運行思科技術,且在網路的整個生命週期中優化它們的性能。
思科及其合作夥伴將針對客戶環境和能力共同構建適當的部署模式,包括技能識別、能力評估及方法差距評估等內容,以便創建一個定制的解決方案,幫助客戶移植到 cisco sona 。
思科資本融資
思科資本®公司在為企業提供此完整解決方案方面發揮著關鍵作用 — 它可即時滿足企業要求。思科資本公司不僅提供交易幫助,還可確保經濟因素不會對企業實施技術的時間產生影響

CISCO PPDIOO

Cisco 生命週期服務的六個階段分別是:
1.準備階段

2.規劃階段

3.設計階段

4.實施階段

5.運行階段

6.優化階段
這一過程簡稱為 PPDIOO。
案例

一.準備階段:準備階段明確業務目標:提升客戶體驗降低成本新增更多服務支援公司擴展 這些目標為商務案例提供了基礎,商務案例用於證明實施技術改進所需的資金投入是合理的。
以下為商務案例:
1) 專案目的:專案如何達到公司業務目標主要效益和風險成功指標
2) 成本/效益分析:實現業務目標的可選方案非財務效益
3) 資源選項:服務所需的資源(外部供應商、網路安裝公司等)採購程式
4) 預算承受能力和整個專案的資金來源(內部及外部),一次投入還是分期投入
5) 項目管理項目計畫和負責人時間表主要風險和將影響降至最小的計畫項目沒有完成時的應急計畫技能和人員要求

二.規劃階段: 在規劃階段,網路設計師對現場和運作情況進行綜合評估,評價物件包括當前網路、運作情況和網路管理基礎架構。NetworkingCompany 員工確定所有需要進行的實際設施修改、環境修改及電氣修改,並評估當前運作情況和網路管理基礎架構對新技術方案的支援能力。所有基礎架構、人員、程式和工具方面的變更都必須在新技術方案實施前完成。 可讓新網路具有更多功能的客制化應用程式也在這一階段確定。最後,NetworkingCompany 員工會創建一份包含所有設計需求的文檔。

三.設計階段:在設計階段,設計公司員工根據規劃階段確定的初步需求進行工作。設計需求文檔在以下方面支持準備階段和規劃階段中明確的技術要求:可用性可擴展性安全性管理便利性 設計必須足夠靈活,以便新目標或新需求出現時能夠作出更改或增補。必須將技術整合到當前的運作和網路管理基礎架構中。

四.實施階段:完成網路設計並經客戶批准後,便進入到實施階段。在實施階段,依據經批准的設計規範構建網路,並驗證網路設計是否成功。

五.運行階段:運行和優化階段是持續進行的過程,反映網路的日常運作情況。讓員工監控網路並建立網路基本模型(BAELINE)。網路監控有助於公司實現最大的可擴展性、可用性、安全性和管理便利性。

六.優化階段: 網路的優化是一個持續不斷的過程。其目的是在發生網路問題之前即找出並解決潛在的問題,從而改善網路的性能和可靠性。優化網路能確保公司的業務目標和需求能得到維護。 可在優化階段中發現的一般網路問題包括:功能不相容鏈路,容量不足啟用多個功能時,設備性能有問題,協定的擴展性問題

HSRP

第二部分 HRRP 熱備份路由式通訊協定, 多台路由器組成一個"熱備份組"用來模擬為一個虛擬的路由器擁有虛擬的IP 位址和虛擬的MAC位址
在一個備份組中,只有一台路由器作為主動路由器發送資料包,只有當主動路由器失效後,將之前選擇的惟一備份路由器轉成為主動路由器轉發資料包,但對於網路中的主機來說虛擬路由器並沒有發生任何改變。
HSRP有三種廣播包:
1.Hello包:hello通知其他路由器,反應本身路由器的HSRP
優先順序和狀態資訊,HSRP路由器預設為每3秒 鐘發送一個hello訊息,可以修改這個參數。
2.Coup包當一個備用路由器變為一個主動路由器時發送一個coup訊息。
3.Resign包當主動路由器要關機時或者當有優先順序更高的路由器發送hello訊息時,主動路由器發送一個resign訊息。

HSRP狀態類型

1.Initial初始化:HSRP啟動時的狀態,HSRP還沒有運行一般是在改變配置或埠剛啟動時進入該狀態。
2.Learn學習狀態:路由器已經得到了虛擬IP位址,但是它既不是主動路由器也不是備份路由器。它一直監聽從主動路由器和備份路由器發來的
HELLO訊息。
3.Listen監聽狀態:路由器處於監聽hello訊息狀態中。
4.Speak對話狀態:在該狀態下路由器定期發送HELLO訊息
並且積極參加主動路由器(Active)或等待路由器(Standby)的競選。
5.Standby被動狀態:當主動路由器失效時準備接手主動路由器轉送封包傳輸功能的路由器。
6.Active主動狀態:路由器執行封包傳輸功能。

HSRP路由器體系
1.主動路由器:負責轉發發送到虛擬路由器的資料。它通過
發送HELLO訊息,基於UDP埠號為1985的廣播來通告它
的主動狀態
2備份路由器:監視HSRP組中的運行狀態,並且在當前主動路由器不可用時,迅速承擔起負責資料轉發的任務。備份路由器也發送HELLO訊息來通
告組中其他的路由器它備份路由器的角色。
3.虛擬路由器:向最終的用戶來代表一台能持續工作的路由器設備。它有自己的MAC和IP地址。但是實際上它是不用來轉發資料包,它的作用僅
僅是代表一台可用的路由設備。 虛擬MAC位址組成:Vendor ID:廠商ID構成MAC位址的頭3個位元組 HSRP代碼表示該位址是HSRP虛擬路由器 的。XX07.acxx 組ID,最後一個位元組是組ID由組號組成

我們可以在主動路由器上使用命令:
show ip arp命令查看
00000c07ac01

4.其他路由器:監聽HELLO訊息,但是不作應答,這樣它就不會在備份組有身份的概念,同時它也不參與發送到虛擬路由器的資料包,但是還是轉發其他路由器發來的資料包。

選舉過程

1.預設情況下優先順序皆為100,這時IP位址最大的會成為主動路由器
2.當主動路由器失效後,備份路由器替代成為主動路由器當主動和備份路由器都失效後,其他路由器將參與主動和備份路由器的選舉工作
a) 優先順序高的成為主動路由器預設值皆為100(介於 0~255 ) ,優先順序別相同時,介面IP位址高的將成為主動路由器,
HSRP支援搶佔,Preempt技術 HRSP技術能夠保證優先順序高的路由器失效恢復後總能處於主動狀態。
主動路由器失效後優先順序最高的備用路由器將成為新的主動路由器,如果沒有使用preempt技術,
則當原來的主動路由器恢復後,只能處於備用狀態,先前的備用伺服器代替其角色處於主動狀態,
直到下一次選舉發生

HSRP的介面追蹤track技術
如果所監測的埠出現故障,則也可以進行路由器的切換。如果主路由器上有多條線路被跟蹤,則當某些線路出現故障時可通過設定來切換到備份路由器上,即使還有其他線路正常工作,直到主動路由器規劃的線路正常工作,才能重新切換回來。
介面追蹤使得能夠根據HSRP組路由器的介面是否可用來自動調整該路由器的優先順序。當被跟蹤的介面不可用時,路由器的HSRP優先順序將降低。
HSRP追蹤特性確保當HSRP主動路由器的重要入站介面不可用時,該路由器不再是主動路由器。
多組HSRP 為了方便負載均衡,同一台路由器可以是同一個網段或VLAN中多個HSRP備用組的成員。配置多個備用組可進一步提高冗餘性,在網路中均衡負載,提高冗余路由器的使用率。
路由器在為一個HSRP組轉發通信流的同時,可以在另一個HSRP組中處於備用或監聽狀態。每個備用組都模擬一個虛擬路由器。在VLAN或介面上最多可以有255個備用組 例如:路由器A和路由器B都是HSRP組1和2的成員然而路由器A是HSRP組1的活躍路由器和HSRP組2的備用路由器而路由器B是HSRP組2的活躍路由器和HSRP組1的備用路由器。
配置過程
——————————–
HSRP組
未定義
備用組編號 0
備用組MAC地址 0000.0c07.acXX XX是HSRP組號 優先順序 100
延時 0沒有延時
跟蹤埠的優先順序 10
HELLO時間 3秒
HOLD時間 10秒
配置要求
1.HSRP最多可以配置32個VLAN或路由介面
2.配置介面必須是3層介面 ,路由介面,
介面使用no switchport並且配置ip位元址
SVI(交換虛擬介面)使用命令interface vlan vlan號
3層乙太網通道(EtherChannel)
3.所有3層介面都必須配置IP位元址
配置HSRP 1
進入全域模式 configure terminal
2 進入介面模式
interface 介面
3 使能HSRP指定熱備份組的組號和虛擬IP 位址 standby 組號 ip IP位址 ,組號取值為0-255,如果是一個備用組可以不輸入組號預設為0 ,ip位址是虛擬的Ip位址,不能為介面上的位址

4.指定備用組的優先順序別
standby 組號 priority 優先順序別
優先順序取值為1-255,預設為100,數值越大級別越高
5.指定搶佔模式,當主動路由器失效後,備份路由器
替換為主動路由器,需要等待的時間
standby 組號 preempt [delay 秒數]
delay取值為0-36001小時
6.設置介面追蹤(可選)
standby 組號 track 埠號 降低的優先順序別
降低的優先順序別預設為10
7.人工指定虛擬mac位元址(可選)
standby 組號 mac mac位址
8.使用實際介面的mac位址(可選),只有25系列路由器使
用
standby 組號 use-bia
9.配置認證(可選)
standby 組號 authentication mode text 密碼
| 密碼:密碼是明文預設為cisco
注意對於IOS12.3以上的版本中
HSRP支持MD5的認證具體配置命令為
standby 組號 authentication md5 key-string 密碼
10.配置HSRP時間(可選)
standby 組號 timers hello秒數 hold秒數
hello秒數取值為1-255預設為3秒
hold秒數取值為1-255預設為10秒
hold time= 3*hello time 核對總和調試

檢驗
show standby
[介面[組]][active|init|listen|standby][brief]
如
show standby Ethernet0 init brief
調測
debug standby:顯示所有的HSRP錯誤、事件和資料包
debug standby terse :顯示除hello和通告以外的所有HSRP錯誤、事件和資料包
debug standby events detail:顯示HSRP事件
debug standby error:顯示HSRP錯誤
debug standby packets [advertise|coup|hello|resign][detail]

案例
sw1(config)#int vlan 10
sw1(config-if)#ip address 192.168.1.1 255.255.255.0

sw1(config-if)#standby 1 ip 192.168.1.254

sw1(config-if)#standby 1 priority 110

————————————————-

sw2(config)#int vlan 10
sw2(config-if)#ip address 192.168.1.2 255.255.255.0

sw2(config-if)#standby 1 ip 192.168.1.254

sw2(config-if)#standby 1 priority 100

————————————————-

SW1#show standby

Vlan10 – Group 1 State is Active 2 state changes, last state change 00:02:38

Virtual IP address is 192.168.1.254

Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default)

Hello time 3 sec, hold time 10 sec Next hello sent in 0.124 secs
Preemption enabled

Active router is local Standby router is 192.168.1.2, priority 100 (expires in 7.992 sec)
Priority 110 (configured 110)
IP redundancy name is “hsrp-Vl10-1″ (default)

—————————————————

SW2#show standy

Vlan10 – Group 1 State is Standby 1 state change, last state change 00:02:32
Virtual IP address is 192.168.1.254
Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default)

Hello time 3 sec, hold time 10 sec Next hello sent in 0.328 secs
Preemption enabled
Active router is 192.168.1.1, priority 110 (expires in 9.456 sec)
Standby router is local Priority 100 (default 100)

IP redundancy name is “hsrp-Vl10-1″ (default)

SW1#show standby brief
P indicates configured to preempt.

Interface Grp Prio P State Active Standby Virtual IP
V10 1 110 P Active local 192.168.1.2 192.168.1.254
多組HSRP備用組

Router A Configuration
Switch# configure terminal
Switch(config)# interface gigabitethernet0/1

Switch(config-if)# no switchport
Switch(config-if)# ip address 10.0.0.1 255.255.255.0

Switch(config-if)# standby 1 ip 10.0.0.3

Switch(config-if)# standby 1 priority 110

Switch(config-if)# standby 1 preempt

Switch(config-if)# standby 2 ip 10.0.0.4

Switch(config-if)# standby 2 preempt

Switch(config-if)# end

Router B Configuration

Switch# configure terminal

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# no switchport

Switch(config-if)# ip address 10.0.0.2 255.255.255.0

Switch(config-if)# standby 1 ip 10.0.0.3

Switch(config-if)# standby 1 preempt

Switch(config-if)# standby 2 ip 10.0.0.4

Switch(config-if)# standby 2 priority 110

Switch(config-if)# standby 2 preempt

Switch(config-if)# end

案例 CCIE-LAB(V160) 題目要求

Configure HSRP on R3 and R4 for hosts on VLAN ACarefully read the requirements,There are 10 hosts on VLAN A。

5 Windows PCs and 5 Unix workstations The Windows PCs are configured to use 160.YY.10.50 as their default gateway
The UNIX workstations are configured to use 160.YY.10.100 as their default gateway
R3 is the preferred router for Windows users.
R4 is the prefered router for Unix users.
If the frame relay connection on R3 goes down then R4 becomes the preferred router for all users。
If the frame relay connection on R4 goes downthen R3 becomes the preferred router for all users。
Once either R3 or R4 recover from a failure then the network must operate as outined above
I.e Each router must resume their original role。
配置 R3 config termi
interface f0/0
standby 1 ip 160.11.10.50
standby 1 priority 110
standby 1 track s0/0 20
standby 1 preempt
standby 2 ip 160.11.10.100
standby 2 preempt

R4 config termi

interface f0/0

standby 1 ip 160.11.10.50

standby 1 preempt

standby 2 ip 160.11.10.100

standby 2 priority 110
standby 2 track s0/0 20
standby 2 preempt

 

Trunk鏈路上的HSRP 此項功能能通過在子網和VLAN間提供負載均衡和冗餘能力提高整個網路的韌性。我們可以實現通過兩個路由器來實現在幹道上的互為活躍/備份路由器。我們只要設置一下他們在HSRP中的優先順序就可以實現。 配置步驟 1 定義封裝類型和vlan 如
interface f0/0.10
encapaulation isl 10
interface f0/0.20
encapaulation isl 20
2.分配IP地址

如 interface f0/0.10
ip address 10.10.10.2 255.255.255.0
interface f0/0.20
ip address 10.10.20.2 255.255.255.0
3.啟動HSRP
如 inteface f0/0.10
standby 1 ip 10.10.10.254
standby 1 priority 105
standby 1 preempt
interface f0/0.20
standby 2 ip 10.10.20.254
standby 2 priority 90

新HSRPv2 在CISCO IOS 12.3以上的版本中,HSRP支援V2的版本。HSRP V2和HSRP V1命令上沒有什麼不同只是HSRP V2所支持的組號進行了擴展HSRP V1只支援0-255個組而HSRP V2可以支援0-4095個組主要是應用在它可以支援匹配在子介面上的VLAN號,擴展的VLAN可以支援到4094個,HSRP V1和HSRP V2不能同時在一個介面上啟用,但是在同一台路由器上的不同介面上可以應用不同版本的HSRP 配置過程
1 進入全域模式 configure terminal
2進入介面模式 interface 介面
3 啟用HSRP版本2
standby version 2
4 配置HSRP standby 組號 ip ip位元址 組號取值範圍0-4095

案例 RouterA#configure terminal

RouterA(config)#interface f0/0

RouterA(config-if)#standby version 2

RouterA(config-if)#standby 4095 ip 10.1.1.1

RouterA(config-if)#standby 4095 timers msec 15 msec 50

RouterA(config-if)#standby 4095 priority 200

RouterA(config-if)#standby 4095 preempt

—————————————————

RouterB#configure terminal

RouterB(config)#interface f0/0

RouterB(config-if)#standby version 2

RouterB(config-if)#standby 4095 ip 10.1.1.1

RouterB(config-if)#standby 4095 timers msec 15 msec 50

RouterB(config-if)#standby 4095 preempt

RouterA#show standby
FastEthernet0/0 – Group 4095 (version 2)
State is Active 2 state changes, last state change 00:11:47
Virtual IP address is 10.1.1.1
Active virtual MAC address is 0000.0c9f.ffff

Local virtual MAC address is 0000.0c9f.ffff (v2 default)

Hello time 15 msec, hold time 50 msec Next hello sent in 0.007 secs Preemption enabled
Active router is local Standby router is 10.1.1.3, priority 100 (expires in 0.030 sec)
Priority 200 (configured 200)
IP redundancy name is “hsrp-Fa0/0-4095″ (default)

CISCO FLEXLINK

FlexLinks Access Model

FlexLinks are an alternative to the looped access layer topology. FlexLinks provide an active-standby
pair of uplinks defined on a common access layer switch. After an interface is configured to be a part of an active-standby FlexLink pair, spanning tree is turned off on both links and the secondary link is placed in a standby state, which prevents it from being available for packet forwarding. FlexLinks operate in single pairs only, participate only in a single pair at a time, and can consist of mixed interface types with mixed bandwidth. FlexLinks are configured with local significance only because the opposite end of a FlexLink is not aware of its configuration or operation. FlexLinks also has no support for preempt, or an ability to return to the primary state automatically after a failure condition is restored.

The main advantage of using FlexLinks is that there is no loop in the design and spanning tree is not enabled. Although this can have advantages in reducing complexity and reliance on STP, there is the drawback of possible loop conditions that can exist, which is covered in more detail later in this chapter. Other disadvantages are a slightly longer convergence time than R-PVST+, and the inability to balance traffic across both uplinks. Failover times measured using FlexLinks were usually under two seconds.



NNote:
When FlexLinks are enabled on the access layer switch, it is locally significant only. The aggregation switch ports to which FlexLinks are connected do not have any knowledge of this state, and the link state appears as up and active on both the active and standby links. CDP and UDLD packets still traverse and operate as normal. Spanning tree is disabled (no BPDUs flow) on the access layer ports configured for FlexLink operation, but spanning tree logical and virtual ports are still allocated on the aggregation switch line card. VLANs are in the forwarding state as type P2P on the aggregation switch ports.


Figure 6 shows the FlexLinks access topology.

Figure 6 FlexLinks Access Topology



The configuration steps for FlexLinks are as follows. FlexLinks are configured only on the primary interface.

ACCESS1#conf t

ACCESS1(config-if)#interface tenGigabitEthernet 1/1

ACCESS1(config-if)#switchport backup interface tenGigabitEthernet 1/2

ACCESS1(config-if)#

    May 2 09:04:14: %SPANTREE-SP-6-PORTDEL_ALL_VLANS: TenGigabitEthernet1/2 deleted from all Vlans

    May 2 09:04:14: %SPANTREE-SP-6-PORTDEL_ALL_VLANS: TenGigabitEthernet1/1 deleted from all Vlans

ACCESS1(config-if)#end


To view the current status of interfaces configured as FlexLinks:

ACCESS1#show interfaces switchport backup


Switch Backup Interface Pairs:


Active Interface Backup Interface State

————————————————————————

TenGigabitEthernet1/1 TenGigabitEthernet1/2 Active Up/Backup Standby


Note that both the active and backup interface are in up/up state when doing a “show interface" command:

ACCESS1#sh interfaces tenGigabitEthernet 1/1

TenGigabitEthernet1/1 is up, line protocol is up (connected)

 Hardware is C6k 10000Mb 802.3, address is 000e.83ea.b0e8 (bia 000e.83ea.b0e8)

Description: to_AGG1

 MTU 1500 bytes, BW 10000000 Kbit, DLY 10 usec,

 reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

 Keepalive set (10 sec)

 Full-duplex, 10Gb/s

input flow-control is off, output flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:09, output 00:00:09, output hang never

Last clearing of “show interface" counters 00:00:30

Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0

 Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 32000 bits/sec, 56 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

1150 packets input, 83152 bytes, 0 no buffer

 Received 1137 broadcasts (1133 multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 0 multicast, 0 pause input

0 input packets with dribble condition detected

 26 packets output, 2405 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

 0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out


ACCESS1#sh interfaces tenGigabitEthernet 1/2

TenGigabitEthernet1/2 is up, line protocol is up (connected)

 Hardware is C6k 10000Mb 802.3, address is 000e.83ea.b0e9 (bia 000e.83ea.b0e9)

Description: to_AGG2

 MTU 1500 bytes, BW 10000000 Kbit, DLY 10 usec,

 reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

 Keepalive set (10 sec)

 Full-duplex, 10Gb/s

input flow-control is off, output flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:51, output 00:00:03, output hang never

Last clearing of “show interface" counters 00:00:33

Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0

 Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 32000 bits/sec, 55 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

1719 packets input, 123791 bytes, 0 no buffer

 Received 1704 broadcasts (1696 multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 0 multicast, 0 pause input

0 input packets with dribble condition detected

 7 packets output, 1171 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

 0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

ACCESS1#


Note that both the spanning-tree is no longer sending BPDUs in an effort to detect loops on interfaces in the FlexLink pair:

ACCESS1#sh spanning-tree interface tenGigabitEthernet 1/1

no spanning tree info available for TenGigabitEthernet1/1

ACCESS1#sh spanning-tree interface tenGigabitEthernet 1/2

no spanning tree info available for TenGigabitEthernet1/2


CDP and UDLD packets are still transmitted across Flexlinks as shown below:

ACCESS1#show cdp neighbor

Capability Codes: R – Router, T – Trans Bridge, B – Source Route Bridge

 S – Switch, H – Host, I – IGMP, r – Repeater, P – Phone


Device ID Local Intrfce Holdtme Capability Platform Port ID

Aggregation-1.cisco.com

 Ten 1/1 156 R S WS-C6509 Ten 7/4

Aggregation-2.cisco.com

 Ten 1/2 178 R S WS-C6509 Ten 7/4


ACCESS1#show udld neighbor

Port Device Name Device ID Port ID Neighbor State

—- ———– ——— ——- ————–

Te1/1 TBM06108988 1 Te7/4 Bidirectional

Te1/2 SCA0332000T 1 Te7/4 Bidirectional

ACCESS1#

FlexLink

下面討論思科FlexLink的操作和使用。

問:什麼是FlexLink?
答:FlexLink 能夠提供第2層永續性,一般在接入交換機和分佈交換機之間運行。它的收斂時間優於生成樹協定/快速生
成樹協定/IEEE 802.1w。FlexLink 在Cisco Catalyst 3000 和 Cisco Catalyst 6000 系列交換機上實施,收斂時
間低於100ms。換言之,從主鏈路的故障檢測,到通過備用鏈路轉發流量,總收斂時間低於100ms。FlexLink 成對部
署,即需要兩個埠。其中一個埠為主埠,另一個埠為從埠。這兩個埠可以是接入埠、EtherChannel埠或中繼埠。


問:FlexLink 是否關閉 Cisco Catalyst 3560-E 上的生成樹協議?

答:不會,FlexLink 只關閉FlexLink 對上的生成樹協定。換言之,只有為 FlexLink (主、從)配置的上行鏈路埠,
才會關閉生成樹協定。為避免網路迴圈,建議不關閉其餘埠上的生成樹協議。

問:備用埠的阻塞方式是否與生成樹協定相同?
答:不必相同。FlexLink 的最新增強允許備用埠對某些VLAN開放。與多生成樹協議相似,這些VLAN都由主埠提供備份。
這種方式稱為負載均衡,即允許使用者使用兩條主鏈路,而不是一條主用、一條備用。某些VLAN能將某條鏈路作為
主用鏈路,另一些VLAN則可以將該條鏈路作為備用鏈路。

問:FlexLink 是否支援負載均衡模式?
答:是的,FlexLink 支援VLAN均衡配置。在雙穴的配置中,某些VLAN 將一條鏈路作為主用鏈路(鏈路A),將另一條
鏈路作為備用鏈路(鏈路B);另一些VLAN則將鏈路B作為主用鏈路,將鏈路A作為備用鏈路。

問:是否能用 FlexLink 建立環拓撲?
不能,FlexLink 的目的是取代生成樹協定,建立上行鏈路,因此,它不支持環拓撲。

問:能否通過 EtherChannel 埠、中繼埠或接入埠配置 FlexLink?
答:可以,FlexLink 能在所有埠類型上配置,包括EtherChannel 埠、中繼埠和接入埠。

問:主、從埠是否必須是同一種埠?
答:不需要。在埠對中,可以將 EtherChannel 埠作為主埠,將接入埠作為從埠,而且主、從埠的速度也可以不同。

問:故障切換之後,當高頻寬主鏈路修復後,是否具有優先使用權?
答:是的,可以打開優先使用權設置,但預設狀態下是關閉的。
優先使用權能根據埠的頻寬配置。當然,為避免頻繁的
主從切換,也能在主鏈路恢復後延期切換。如果需要強迫使用優先使用權,應忽略延期計時器。

問:FlexLink 是否建立了調整機制,以便用戶能夠避免鏈路頻繁變動?
答:是的,為避免頻繁的主從切換,可以在主鏈路恢復後延期切換。

問:是否需要啟用 FlexLink 的MAC 移動更新(MMU)?
答:不需要,但是,為了加快雙向收斂,建議使用MMU。MMU 能夠向分佈層的交換機通報 MAC 表變更情況。
注意:Cisco
Catalyst 6000 產品線目前不支援MMU,但已列入了發展計畫。

問:運行 FlexLink 時是否需要關閉生成樹協定?
答:不需要,預設狀態下,生成樹協定只在 FlexLink 對上關閉,交換機的其它埠和VLAN上將繼續使用該協議。

System Log

Cisco設備的日誌發往syslog服務器

CISCO交換機的設置舉例

(1) 以下配置描述了如何將Cisco設備的日誌發往syslog服務器
思科路由器配置

cisco#conf t
cisco(config)#service timestamps log datetime localtime//日誌記錄的時間戳設置,可根據需要具體配置

cisco(config)#logging on //啟用日誌
cisco(config)#logging a.b.c.d //日誌服務器的IP地址
cisco(config)#logging facility local1 //facility設四標識, RFC3164 規定的本地設備標識為 local0 – local7
cisco(config)#logging trap errors //日誌記錄級別,可用"?"查看詳細內容 這個是3的級別

Severity Level
可選的級別有0-7共八個級別,0最高,7最低。這八個級別分別為:
emergencies System is unusable (severity=0)
alerts Immediate action needed (severity=1)
critical Critical conditions (severity=2)
errors Error conditions (severity=3)
warnings Warning conditions (severity=4)
notifications Normal but significant conditions (severity=5)
informational Informational messages (severity=6)
debugging Debugging messages (severity=7)

cisco(config)#logging source-interface e0 //日誌發出用的源IP地址

cisco#sh logging
選取最低的debugging級別可以記錄所有可以記錄的資訊思科路由器交換機,包括系統資訊、錯誤資訊思科路由器交換機模擬軟件、debug資訊等等。但是仍然不能滿足我們的全部需求

 

Note: using NTP to make time accurately

SNMP V1,V2C,V3

本文主要重點在後面的SNMP v3的配置。

另外SNMP測試可以使用iReasoning MIB,在http://www.ireasoning.com/ 可以下載到。

技術總結:

SNMP是Simple Network Manger Protocol(簡單網路管理協定)的縮寫,利用SNMP協定,網路系統管理員可以對網路上的節點進行資訊查詢、網路配置、故障定位、容量規劃,網路監控和管理是SNMP的基本功能。

SNMP是一個應用層協議,為客戶機/伺服器模式,包括三個部分:

1. SNMP網路管理器 //一般即為主機上的網管軟體,HP OPENVIEW ,SOLDWIND 等,現今的大規模網路管理都使用此協定, UDP 162 由於trap消息為代理主動發送,此處需要埠號

2.SNMP代理 //路由器交換機等網路設備上運行的SNMP程式,負責處理請 求及回應的 UDP 161

3. MIB管理資訊庫 // 預先定義好的樹形結構庫,單個節點代表一個資訊

MIB的相關概念:

下為MIB的一示例,很抽象,學習過資料結果的應該不陌生。

示例每個葉子節點代表一個屬性,可以囊括網路產品的所有樹形,如設備型號,電源狀態,介面速率,流量類型等等。

1.3.6.1.2.1.5
為節點ICMP,在網管軟體中獲取此節點與子節點的資訊,可以得到所有與ICMP有關的資訊與操作。


管理資訊結構SMI(structure of management information) :

指定了在 SNMP 的 MIB 中用於定義管理目標的規則。

SMI 是一種語言,是為了確保網路管理資料的語法和語義明確和無二義性而定義的語言。 如整數型,浮點型,二進位型,IP網址類別型,資料結構等。

它是定義被管理網路實體中特定資料的語言。

它定義了資料類型、物件模型,以及寫入和修改管理資訊的規則。讀寫許可權。


目前的SNMP版本:

1. SNMPv1 :簡單網路管理協定的第一個正式版本,在RFC1157中定義。

2. SNMPv2C:基於社群體(Community-Based)的SNMPv2管理架構, 在RFC1901中定義的一個實驗
性協議。

3. SNMPv3 :通過對資料進行鑒別和加密,提供了以下的安全特性:

1) 確保資料在傳輸過程中不被篡改;

2) 確保資料從合法的資料來源發出;

3) 加密報文,確保資料的機密性;

SNMPv2C是對SNMPV2的改進,增加了Get-bulk操作機制並且能夠對管理工作站返回更加詳細的錯誤資訊類型。Get-bulk操作能夠一次性地獲取表格(注意與walk的區別,walk是獲取所有表的資訊)中的所有資訊或者獲取大批量的資料,從而減少請求-回應的次數。避免多次getnext.


SNMP管理操作:

SNMP協定中的NMS和Agent之間的交互資訊,定義了6種操作類型:

1) Get-request操作:NMS從Agent提取一個或多個參數值。

2) Get-next-request操作:NMS從Agent提取一個或多個參數的下一個參數值。

3) Get-bulk操作:NMS從Agent提取批量的參數值;一個表格,SNMPV1不支援

4) Set-request操作:NMS設置Agent的一個或多個參數值。節點要有可寫屬性

5) Get-response操作:Agent返回的一個或多個參數值,是Agent對NMS前面3個操作的回應操作。

6) Trap操作:Agent主動發出的報文,通知NMS有某些事情發生。

將某些用戶和一個組關聯,再將某個組與某個視圖關聯。


snmp-server view
view-name oid-tree {include | exclude} //定義可以被訪問或者排除的MIB

snmp-server group
groupname {v1 | v2c |v3 {auth | noauth | priv}} [read readview] [write
writeview] [access {[ipv6 ipv6_aclname] [aclnum | aclname]
}] //創建組並和視圖關聯

Ruijie(config)# snmp-server user
username roupname {v1 | v2 | v3 [encrypted] [auth { md5|sha } auth-password ] [priv
des56
priv-password] } [access {[ipv6
ipv6_aclname] [aclnum | aclname]
}] //配置使用者和組關聯


配置實例:

1、snmpv1/v2模式均只要一條命令:

snmp-server comm. gaodong rw //gaodong相當於共用的密碼,為明文傳輸

snmp-ser enable traps //開啟trap通告

snmp host 192.168.225.147 traps gaodong //trap發往的主機位址

2、SNMP V3的配置

認證不加密型:

snmp-server user gduser gdgroup v3 encrypted auth md5 gdong //用戶名,組,認證方式,認證密碼

snmp-server group gdgroup v3 auth read default write default //認證組賦予許可權,auth為只認證不加密,其中default為默認的view視圖,此view可自行定義,但有的設備不支援

snmp-server host 192.168.45.96 traps version 3 auth gduser //TRAP通告地址。指定用戶名

snmp-server enable traps

snmp-server community gd rw

(紅色部分均填寫md5的認證模式—md5)

、認證加密型:

snmp-server user gduser gdgroup v3 encrypted auth md5 gdong priv des56 gaod //指定認證加密的類型,密碼,使用者與組關聯

snmp-server group gdgroup v3 priv read default write default //定義組的許可權,priv為既認證又加密

snmp-server host 192.168.45.96 traps version 3 priv gduser

snmp-server enable traps

snmp-server community gd rw

、不認證,不加密型:

snmp-server user gduser gdgroup v3 //用戶名與組關聯,指定版本號

snmp-server group gdgroup v3 noauth read default write default //定義組的許可權,noauth為既不認證也不加密

snmp-server host 192.168.45.96 traps version 3 noauth gduser

snmp-server enable traps

snmp-server community gd rw

3 包含視圖的配置實例:

以下的配置允許SNMPv3的管理者採用認證+加密模式通過用戶名v3user對MIB-2(1.3.6.1.2.1)節點下的管理變數進行設置和查看。採用的認證模式為MD5,使用的認證密碼為MD5-Auth,採用DES加密,加密金鑰為DES-Priv。同時允許向192.168.65.199以SNMPv3格式發送Trap。發送Trap使用的用戶名為v3user,採用認證+加密模式發送,採用的認證模式為MD5,使用的認證密碼為MD5-Auth,採用DES加密,加密金鑰為DES-Priv。

(config)# snmp-server view v3userview 1.3.6.1.2.1
include

(config)# snmp-server group v3usergroup v3 priv read v3userview write v3userview

(config)# snmp-server user v3user v3usergroup v3 auth md5 md5-auth priv des56 des-priv

(config)# snmp-server host 192.168.65.199 traps version 3 priv v3user

Switch 1.0 Ref 2 802.1X and VACL

CISCO 交換機 配置AAA、802.1X以及VACL

CISCO, AAA, VACL, 交換機

CISCO交換機配置AAA、802.1X以及VACL

一 啟用AAA、禁用Telnet 以及啟用 ssh

1.啟用aaa身份驗證,以進行SSH訪問:
Switch# conf t
Switch(config)# aaa new-model

2.配置主機名稱
Switch(config)# hostname sw1

3.配置本地用戶名口令,以便在帶外伺服器不可用時能夠訪問交換機
sw1(config)# username cisco password cisco

4.配置SSH
sw1(config)# ipdomain-name cisco.com
sw1(config)# crypto key generate rsa
! 如果要支援 SSH V2 ,在Cisco 設備上要求key長度大於"768 bits"
5.配置交換機,使得只能通過SSH以帶內方式訪問交換機
sw1(config)# line vty 0 15
sw1(config-line)# transport input ssh
sw1(config-line)# exit
sw1(config)# exit

二 配置vty的aaa身份驗證方式,首先使用radius 伺服器,如果伺服器不可用,使用本地用戶名口令資料庫
sw1(config)# aaa authentication login TEST group radius line
sw1(config)# line vty 0 15
sw1(config-line)# login authentication TEST
sw1(config-line)# exit

  • 三 在介面上配置802.1x

    1.為radius身份驗證啟用802.1x
       sw1(config)# aaa authentication dot1x default group radius

    2.全域啟用802.1x
       sw1(config)#dot1x system-auth-control

    3.在介面上配置802.1x
       sw1(config)# int range fa0/2 – 10
       sw1(config-if-range)# swtichport access vlan 10
       sw1(config-if-range)# dot1x port-control auto

    四 配置vacl以丟棄所有通過tcp埠8889進入的Frame

    1.配置一個acl,以判斷資料包是否通過tcp埠8889進入:
       sw1(config)# access-list 100 permit tcp any any eq 8889

    2.配置vlan訪問映射表:
       sw1(config)# vlan access-map DROP_WORM 100
       sw1(config-access-map)# match ip address 100
       sw1(config-access-map)# action drop
       sw1(config-access-map)# exit

    3.將vlan訪問表應用於合適的vlan
        (config)#vlan filter DROP_WORM vlan 10-20

    802.1x筆記

      在某網路測試時筆記。

    一、802.1x協定起源於802.11協定,後者是標準的無線局域網協定,802.1x 協定的主要目的是為了解決無線局域網使用者的接入認證問題。
    現在已經開始被應用於一般的有線LAN的接入。為了對埠加以控制,以實現用戶級的接入控制。
    802.1x就是IEEE為了解決基於埠的接入控制(Port-Based Access Control)而定義的一個標準。
    1、802.1X首先是一個認證協定,是一種對使用者進行認證的方法和策略。
    2、802.1X是基於埠的認證策略(這裡的埠可以是一個實實在在的物理埠也可以是一個就像VLAN一樣的邏輯埠,
    對於無線局域網來說個"埠" 就是一條通道)
    3、802.1X的認證的最終目的就是確定一個埠是否可用。對於一個埠,如果認證成功那麼就"打開"這個埠,
    允許文所有的資料通過;如果認證不成功就使這個埠保持"關閉",此時只允許802.1X的認證資料EAPOL
    (Extensible Authentication Protocol over LAN)通過。

    二、802.1X的認證體系分為三部分結構:
    Supplicant System,用戶端(PC/網路設備)
    Authenticator System,認證系統 (目前為Switch ,Autonomous AP , or WLAN Controller)
    Authentication Server System,認證伺服器 (Only Support EAP support Radius Server)

    三、認證過程

    1、認證通過前,通道的狀態為unauthorized,此時只能通過EAPOL的802.1X認證資料;
    2、認證通過時,通道的狀態切換為 authorized,此時從遠端認證伺服器可以傳遞來使用者的資訊,
    比如VLAN、CAR參數、優先順序、用戶的存取控制清單等等;
    3、認證通過後,用戶的流量就將接受上述參數的監管,此時該通道可以通過任何資料,注意只有認證通過後才有DHCP等過程。
    4、Supplicant System- Client(用戶端)是—需要接入LAN/WLAN,及享受switch/AP提供服務的設備(如PC機),
    用戶端需要支援EAPOL協定,用戶端必須運行802.1X 用戶端軟體,如:802.1X-complain、Windows XP等

    四、配置
    1、先配置switch到radius server的通訊
    2. 全域啟用802.1x身份驗證功能
    Switch# configure terminal
    Switch(config)# aaa new-model
    Switch(config)# aaa authentication dot1x {default} method1[method2…]
    3.指定radius伺服器和金鑰
    switch(config)#radius-server host ip_add key string
    4、在port上起用802.1x
    Switch# configure terminal
    Switch(config)# interface fastethernet0/1
    Switch(config-if)# switchport mode access
    Switch(config-if)# dot1x port-control auto
    Switch(config-if)# end

    五802.1x的安全機制
    IEEE 802.1x作為一種新生的鏈路層驗證機制協議,其原理、組成、工作進程以及功能等到底如何呢?
    上文揭示了這項協定在網路安全方面的運行機理及其突出應用。
    雖然大多數組織的IT基礎設施已經加強了邊界防禦,但其內部仍然容易受到攻擊。這種脆弱性具體表現為內部用戶可未經授權訪問
    或者惡意破壞關鍵的IT資源。作為全面的"深層防禦"安全架構的一部分,關鍵內部基礎設施的訪問權只能提供給授權使用者。
    局域網(LAN)歷來是大門敞開。IEEE 802.1x這項最新標準定義了為LAN實施存取控制的機制,允許授權使用者進來,而把非授權使用者拒之門外。因此,
    有了802.1x,LAN便不再是一道敞開的門,其本身也成為安全架構和政策執行的一個重要部分,並有助於消除來自組織內部的安全威脅。

    802.1x驗證機制及其優點

    IEEE 802.1x是一種鏈路層驗證機制協定,控制著對網路訪問埠即網路連接點的訪問,如實施在無線接入點的物理交換埠或邏輯埠。
    通過控制網路訪問,使用者可以在多層安全架構部署第一道防線。在連接設備得到驗證之前,網路訪問權完全被禁止。
    得到驗證之後,用戶可以被提供第2層交換機通常提供的服務以外的附加服務。這些服務包括第3層過濾、速率限制和第4層過濾,
    而不僅僅是簡單的"開/關(on/off)"服務。

    鏈路層驗證方案的一個優點是,它只要求存在鏈路層連接,用戶端(在802.1x中稱為請求者)不需要分配供驗證用的第3層位址,
    因而降低了風險。此外,鏈路層驗證涉及了所有能夠在鏈路上工作的協議,從而不必為每種協定提供網路層驗證。
    802.1x還能夠使執行點盡可能地接近網路邊緣,因此可以針對連接設備的特定需求定制細細微性訪問規則。

     

  • IEEE 802.1x的組成

    IEEE 802.1x定義了下列邏輯單元:
    網路訪問埠:
    即網路上的連接點,它可能是物理埠,也可能是邏輯埠。

    請求者:
    連接到網路、請求其服務的設備,通常是終端站。請求者是請求驗證的設備,但也有可能是一種網路設備。

    驗證者:
    為驗證服務提供便利的網路單元,驗證者實際上並不提供驗證服務,它充當請求者和驗證伺服器之間的代理,並且充當政策執行點。
    埠訪問實體:參與驗證過程的硬體。請求者和驗證者都擁有埠訪問實體(PAE)單元,請求者的PAE負責對驗證資訊請求做出回應,
    驗證者的PAE負責與請求者之間的通信,代理授予通過驗證伺服器驗證的證書,並且控制埠的授權狀態。

    驗證伺服器:
    提供向驗證者申請驗證服務的實體,它根據證書提供授權,既可以同驗證者放在一起,也可以放在遠地。

    擴展驗證協定(EAP)
    由於使用了擴展驗證協定(EAP),802.1x在請求者和驗證者之間採用的實際驗證機制相當靈活。
    EAP原先是為點對點(PPP)鏈路上的應用而定義的, 明確定義在網際網路工程任務組的請求評論文檔(RFC)2284。
    基於以上所述,IEEE定義了一種封裝模式,允許EAP通過LAN傳輸,EAP over LAN(EAPoL)於是應運而生。
    各種驗證服務都可以通過這種協定運行,包括用帳戶/密碼、Kerberos、數位憑證、一次性密碼和生物檢測術等服務。
    EAP資料包在請求者和驗證者之間的鏈路層上傳輸,並通過驗證者與驗證伺服器之間的IP/RADIUS連接。

    EAP本身並不為流量傳輸明確規定任何保護機制,如加密等。相反,EAP內運行的驗證協議(在RFC 2284當中定義為驗證類型)
    為安全操作提供了資料的機密性和完整性。驗證類型的一個例子就是EAP傳輸層安全(EAP-TLS),它利用了在RFC 2246中定義
    的傳輸層協議(TLS)。

    受控埠和不受控埠

    802.1x標準定義了兩種邏輯抽象:受控埠和不受控埠。這兩種埠都連接到網路訪問埠上。受控埠提供了訪問請求者所用的網路服務的功能,根據驗證操作成功
    與否實現打開或關閉操作。不受控埠始終處於連接狀態,為驗證服務的進行提供了始終連通的狀態。受控埠需驗證通過後才處於連接狀態,從而提供給請求者
    網路服務。

    802.1x的工作過程

    802.1x的工作相當簡單。值得注意的是請求者和驗證者之間的流量通過EAPoL傳輸,驗證者與驗證伺服器之間的流量則通過RADIUS傳輸。
    開始時,受控埠處於中斷狀態,所以請求者無法訪問LAN本身。請求者向驗證者發出EAPoL起始消息,或者驗證者會向請求者發出EAP請求身份消息。請求者接到請求身份消息後,就會把證書提供給驗證者,然後驗證者進行封裝後把RADIUS資料包裡面的消息發送給驗證伺服器。

    RADIUS伺服器隨後向請求者發出質問請求,該請求由驗證者充當代理。請求者對質問做出回應後,驗證者又一次充當資料通過驗證伺服器的代理。驗證伺服器確認證書後,就會做出請求者可不可以使用LAN服務的決定。只要讓受控埠由中斷狀態轉換到連接狀態,即可實現這一步。

    增強授權功能

    因為802.1x只明確規定了基本的開/關功能,其他功能甚少,大多數安全專家提到了AAA,即驗證、授權和審計,而802.1x僅僅提供了最基本的驗證功能,即開/關。部分廠商於是提供了另一層保護,因為許多組織需要比"開/關"所能夠實現的更高一級的細細微性。廠商為受控埠增添邏輯以提高保真度,從而大大增強了授權功能。這種所謂的授權服務可以提供高保真度的第2、第3和第4層過濾功能,而且可以進行擴展,以獲得動態自我配置的資料包過濾防火牆。授權服務可以提供如下的一些服務:

    第2層協定過濾,去除了網路中不接受的第2層協議。
    第3層過濾,對提供特定單元訪問權的網路執行邏輯視圖。
    第4層過濾,禁止不允許的協定進入網路。
    速率限制,控制可能有害的資訊進入網路的速率。

    如果利用為每個埠進行程式設計的授權服務,就能針對特定用戶或用戶級制訂相應的細細微性安全性原則,為它們提供僅供訪問所需服務的功能,
    其它服務一概禁止。

    舉一例,即使網路系統管理員能訪問SNMP,會計部門的人卻沒有理由同樣能訪問。如果有可能確定一個用戶屬於哪個組,那麼在驗證期間就可以實施特定的授權策略。就本例而言,SNMP訪問權應該授予網路管理組的成員,不然需收回許可權,從而防止網路系統管理員之外的人無意或惡意對網路設備亂加配置。

Switch 1.0 ref 1-Port Fast,uplink fast ,back fast , Bpdu guide , bpdu fast

Switch 1.0 ref 1-Port Fast,uplink fast ,back fast , Bpdu guide , bpdu fast

 

 

PortFast(802.1D快速轉送埠):
主要用於access 埠,能繞過監聽和學習狀態直接進入轉發狀態 節省30S
埠下用spanning-tree portfast (cisco 專有){disable | truck }
由於是接入埠,正常情況下是不會接受到BPDU 的,如果接受到了BPDU,STP 就要想辨法把這個埠轉到阻塞(BLOCK)狀態-“portfast bpduguide" ,
全域命令

 

spanning-tree portfast bpduguard,當收到BPDU,STP 把這個埠關閉掉,更好的保護埠,(ERROR-DISABLE)
spanning-tree portfast bpdufilter default,default是所有介面的意思,則當收到BPDU 時,STP 把該埠變為普通埠,不再是portfast 埠,

用show spanning-tree summay totals 查看
UplinkFast(802.1D快速上行鏈路-Switch require own Root port & Block Port):
在有冗余的鏈路中使用,當啟用的那條鏈路斷掉,另一條備份鏈路繞過監聽和學習狀態直接進入轉發狀態 節省30S 。如果原來的交換機恢復連接,交換機在等待2倍轉發延遲時間再加上5s後才將該埠轉入轉發狀態。
這使得鄰接埠有時間經過偵聽和學習狀態轉入轉發狀態。
全域下用spanning-tree uplinkfast (cisco 專有)

本帖隱藏的內容需要回復才可以流覽

BackboneFast(802.1D快速骨幹-Block Port and Root Port are not on same switch ):
在一個STP 實例的整個網路交換機上使用,當一個交換機從被阻塞的埠收到一個劣等BPDU 時,它查詢根交換機後發現網路改變,就把原來那個阻塞埠馬上轉到監聽狀態,
而不用等待Max Age 的時間 節省20S (Via Root LINK Query
在全域下用spanning-tree backbonefast (cisco 專有)

Root guard:
(config-if)#spanning-tree guard root 啟用根防護,埠只能轉發BPDU而不能接收BPDU,禁止埠成為根埠,當接收到較好的BPDU時該埠則進入阻斷狀態。

用於防止新加入具有更小優先順序交換機成為根橋在連接新加入的交換機的交換機埠上用spanning-tree guard root 保護原有的根交換機,把這個埠自動阻塞,
用show spanning-tree inconsistentports 查看因為根保護而被阻塞的埠

BPDU guard:
全域命令
spanning-tree portfast bpduguard,當收到BPDU,STP 把這個埠關閉掉,更好的保護埠,
spanning-tree portfast bpdufilter default,default是所有介面的意思,則當收到BPDU 時,STP 把該埠變為普通埠,不再是portfast 埠,

(config-if)#spanning-tree portfast{ bpduguard | bpdufilter }default 埠上啟用了PortFast將自動啟用BPDU 防護,啟用後收到BPDU埠將進入errdisable狀態被關閉,所以上行鏈路埠不應啟用
介面下:spanning-tree bpduguard [enable | disable]
spanning-tree bpdufilter [enable | disable] 介面下不收發BPDU可能產生迴圈

所有這種既能在全域模式下配置又能在介面模式下配置的,都是介面配置可以覆蓋全域配置

Types of Ethernet

Types of Ethernet

As mentioned earlier, Ethernet provides various data rates with different physical layouts. A variety of Ethernet types have come and gone over the years, such as the following:

  • 10BASE5 (Thicknet)
  • 10BASE2 (Thinnet)
  • 10BASE-FL
  • 10BASE-T

In the mid 1990s, 100BASE-T (unshielded twisted-pair [UTP]) and 100BASE-FX (using fiber) were ubiquitous in the enterprise network, and they still are. Since the start of the millennium, enterprise networks have actively implemented Gigabit Ethernet, 1000BASE-T, in their network. The push for today is 10 Gbps in the core of the enterprise network.

Transmission Media

The more common transmission media are twisted pair and fiber optics. Coaxial cable is mentioned in this section for historical purpose. Categories defined under twisted pair support transmission over various distances and data rates. The most common UTP cable in the enterprise network is Category 5, which supports 100 Mbps and 1000 Mbps rates.

Ethernet over Twisted-Pair Cabling

Ethernet technology standards are the responsibility of the IEEE 802.3 working group. This group is responsible for evaluating and eventually approving Ethernet specifications as new Ethernet technologies are developed such as Gigabit and 10Gigabit Ethernet. Although this group defines the standards for Ethernet, it looks to other established standards organizations to define the specifications for physical cabling and connectors. These organizations include the American National Standards Institute (ANSI), Engineering Industry Association (EIA), and Telecommunications Industry Association (TIA). The TIA/EIA published specifications for twisted-pair cabling are found in the TIA/EIA-568-B specification document.

The more common forms of cabling are unshielded twisted-pair (UTP) and optical fiber. Twisted pair cable comes in a variety of forms. The most common categories in today’s networks are the following:

  • Category 3
  • Category 5
  • Category 5E
  • Category 6

The categories represent the certification of the radio frequency capability of the cabling.

Category 3 was initially designed as voice grade cable and is capable of handling transmissions using up to 16 MHz. Category 5 is capable of handling transmissions up to 100 MHz. Category 5E is an improved version of Category 5; while still limited to 100 MHz, Category 5E defines performance parameters sufficient to support 1000BASE-T operation.

Category 6 provides the best possible performance specification for UTP cabling. Category 6 specifies much stricter requirements for cabling than Category 5 and 5E. The frequency range of Category 6 extends to 250 MHz, in contrast to Category 5 and 5E’s 100 MHz. While new cabling installations typically install Category 5E or 6 cabling, Category 5 cabling can be utilized for 1000BASE-T applications. With few exceptions, if 100 Mbps Ethernet is operating without issues up to 100 meters on a Category 5 cable plant, 1000BASE-T will operate as well.

Although 10 Mbps and 100 Mbps Ethernet often use two pairs (pins 1, 2, 3, and 6) of twisted-pair cabling, Gigabit Ethernet over twisted pair uses all four pairs of wiring in the twisted-pair cable.

Even if the actual twisted pair is rated a specific category, it does not imply that a cabling infrastructure properly supports the category specification end-to-end. Installation and accessories (such as patch panels and wall plates) must meet the standard as well. Cable plants should be certified from end-to-end. When installing a cabling infrastructure, the installer should be able to use specialized equipment to verify the specifications of the cabling system from end-to-end.

Ethernet over Fiber Optics

Two major types of fiber used in Ethernet networks are multimode and single mode. Multimode fiber (MMF) is used for short haul applications (up to 2000 m). Examples include campus or building networks. MMF is usually driven by LED or low-power laser-based equipment. Single mode fiber (SMF) is used for longer haul applications (up to 10 km) and the equipment is laser based. SMF is generally used in metropolitan-area networks or carrier networks.

Table 1-1 compares Ethernet types over different transmission media.

Table 1-1. Comparisons of Ethernet over Various Transmission Media

Ethernet Type

Media Type

Distance Limitations (meters)

Speed (megabits)

Data Encoding

10BASE-T

UTP Category 3 or better

100

10

Manchester

10BASE-FX ? MMF

MMF

2000

10

Manchester

100BASE-TX

UTP Category 5 or better

100

100

4B/5B

100BASE-FX ? MMF

MMF

2000

100

4B/5B

100BASE-FX ? SMF

SMF

10000

100

4B/5B

1000BASE-SX

MMF

2000

1000

8B/10B

1000BASE-LX

SMF

5000[*]

1000

8B/10B

1000BASE-T

UTP Category 5 or better

100

1000

PAM 5×5

 

[*] The Cisco implementation of 1000BASE-LX doubles this distance over the standard to 10,000 meters

Ethernet over Coax Cabling

The use of coax cable for LANs is virtually nonexistent. One might run into it in an old abandoned building. Ethernet’s eventual support of twisted pair cabling in a star topology virtually ended the use of coaxial cabling for Ethernet. Keep in mind that coax cable was not cheap either. Two major types of coax were used: thinnet (also called cheapernet) and thicknet. Thinnet uses 50 ohm coaxi cable (RG-58 A/U) with a maximum length of 185 meters when used for Ethernet. This cable is thinner and more flexible than thicknet, which is also 50 ohm coax cable. It is packaged and insulated differently than thinnet. It requires a specialized tool, a vampire tap, to pierce into and has a maximum length of 500 meters for Ethernet. The vampire tap was used to pierce the outer shielding of the cable, creating an electrical connection between the device and the shared media. Traditionally, thicknet was used as a backbone technology because of its additional shielding. Both thinnet and thicknet are virtually extinct in production networks today.

Ethernet Cross-Over Cabling

Network devices can be categorized as either data circuit equipment (DCE) or data terminating equipment (DTE). DCE equipment connects to DTE equipment, similar to the male and female end of a garden hose. DCE equipment usually is a type of concentrator or repeater, like a hub. DTE equipment is usually equipment that generates traffic, like a workstation or host.

Sometimes, it is necessary to connect like equipment. Connecting like devices can be accomplished by altering the twisted-pair media, and taking transmit and receive wires and reversing them. This is commonly called a “cross-over" cable. Figure 1-2 shows an RJ-45 connector with its pinouts. Pins 4, 5, 7, and 8 are not used.

Figure 1-2. Crossover Pinouts


 

The pinouts are a bit different in a Gigabit scenario because all the pins are used. In addition to the pinouts for 10 Mbps/100 Mbps aforementioned, two additional changes are necessary: pin 4 to 7, and 5 to 8.

A crossover cable can link DCE to DCE, and DTE to DTE. The exception to connecting like devices is that some devices are manufactured to be connected together. An example would be that some hubs and switches have an uplink or Media Dependent Interface (MDI) port. There is typically a selector that allows the user to toggle between MDI and MDI-X (X for crossover), with MDI-X intentionally reversing the pin out of transmit and receive similar to a crossover cable. A setting of MDI-X allows two DCE devices, such as two hubs or switches, to connect to each other using a typical straight through wired twisted-pair cable.

Ethernet Topology

Ethernet is defined at the data link layer of the OSI model and uses what is commonly referred to as a bus topology. A bus topology consists of devices strung together in series with each device connecting to a long cable or bus. Many devices can tap into the bus and begin communication with all other devices on that cable segment. This means that all the network devices are attached to a single wire and are all peers, sharing the same media.

Bus topology has two very glaring faults. First, if there were a break in the main cable, the entire network would go down. Second, it was hard to troubleshoot. It took time to find out where the cable was cut off. The star topology has been deployed for a long time now and is the standard in the LAN environment. Star topologies link nodes directly to a central point. The central point is either a hub or a LAN switch. Ethernet hubs are multiport repeaters, meaning they repeat the signal out each port except the source port.

The advantages of a physical star topology network are reliability and serviceability. If a point-to-point segment has a break, in the star topology, it will affect only the node on that link. Other nodes on the network continue to operate as if that connection were nonexistent. Ethernet hubs and LAN switches act as the repeaters that centralize the twisted-pair media. Twisted-pair media can also be used to join like devices. Following the OSI model and the concept of interchangeable parts, even Token Ring, which is a logical ring, can use a physical star topology with twisted pair.

Ethernet Logical Addressing

In Ethernet, LAN devices must have a unique identifier on that specific domain. LAN devices use a Media Access Control (MAC) address for such purpose. MAC addresses are also referred to as hardware addresses or burned-in addresses because they are usually programmed into the Ethernet adapter by the manufacturer of the hardware.

The format of a MAC address is a 48-bit hexadecimal address. Because hexadecimal uses the digits 0-9 and the letters a-f (for numbers 10-15), this yields a 12-digit address. MAC addresses are represented in any one of four formats. All the formats properly identify a MAC address and differ only in the field separators, as follows:

  • Dashes between each two characters: 00-01-03-23-31-DD
  • Colons instead of dashes between each two characters: 00:01:03:23:31:DD
  • Periods between each fourth character: 0001.0323.31DD
  • The digits without dashes, periods, or colons: 0001032331DD

Cisco routers typically use the 0001.0323.31DD formatting, while Cisco switches running Catalyst Operation System (Catalyst OS) images use 00:01:03:23:31:DD to represent the same address.

CSMA/CD Operation

Ethernet operates using CSMA/CD. By definition, CSMA/CD is half-duplex communication. Half duplex implies that only one device on the Ethernet LAN “talks" at a time, and devices connected to the same Ethernet network are considered to be part of the same collision domain. Devices sending traffic in the same collision domain have the potential of their packets colliding with each other when two devices attempt to transmit at the same time. The logical definition of this range of devices is called a domain, hence the term collision domain.

The old style telephone party line example best illustrates the concept of a collision domain, as shown in Figure 1-3.

Figure 1-3. Telephone Party Line


 

Table 1-2 lists each party line operation and compares it to Ethernet.

Table 1-2. Comparing Party Line and Ethernet Operations

Step

Telephone Party Line Operation

Ethernet Operation

1

I pick up the phone. Is anyone talking?

The LAN device listens to the Ethernet network to sense the carrier signal on the network.

2

If no one is speaking, I can start talking. I’ll keep listening to make sure no one speaks at the same time as me.

If the LAN device does not detect a carrier signal on the network, it can begin transmitting. The LAN device listens to the carrier signal on the network and matches it to the output.

3

If I can’t hear myself speak, I’ll assume someone is trying to speak at the same time.

If there is a discrepancy between input and output, another LAN device has transmitted. This is a collision.

4

I’ll then yell out to tell the other person to stop talking.

The LAN device sends out a jamming signal to alert the other LAN devices that there has been a collision.

5

I will then wait a random amount of time to start my conversation again.

The LAN device waits a random amount of time to start transmitting again. This is called the backoff algorithm. If multiple attempts to transmit fail, the backoff algorithm increases the amount of time waited.

 

In a party line, people occasionally speak over each other. When the party line is loaded with more callers, the more often people attempt to speak at the same time. It is the same with Ethernet collisions. Because users share Ethernet bandwidth and are part of the same collision domain, it is often referred to as shared media or shared Ethernet. (See Figure 1-4.) The efficiency of shared Ethernet is proportional to the number of devices attempting to communicate at the same time. As more devices are added, the efficiency decreases.

Figure 1-4. Shared Ethernet Segment


 

The algorithm in CSMA/CD used after a collision is Truncated Binary Exponential Backoff algorithm. When a collision occurs, the device must wait a random number of slot times before attempting to retransmit the packet. The slot time is contingent upon the speed of the link. For instance, slot time will be different for 10 Mbps Ethernet versus 100 Mbps Ethernet. Table 1-3 shows an example for a 10 Mbps Ethernet link. Cisco switches uses a more aggressive Max Wait Time than what is illustrated in this example. The purpose of the example is to give you a feel for how Truncated Binary Exponential Backoff works.

Table 1-3. CSMA/CD Collision Backoff Ranges

Retry

Range

Max Number

Max Wait Time

1st

0-1

(2^1)-1

51.2us

2nd

0-3

(2^2)-1

153.6us

3rd

0-7

(2^3)-1

358.4us

4th

0-15

(2^4)-1

768.0us

5th

0-31

(2^5)-1

1587.2us

6th

0-63

(2^6)-1

3225.6us

7th

0-127

(2^7)-1

6502.4us

8th

0-255

(2^8)-1

13056.0us

9th

0-511

(2^9)-1

26163.2us

10th ? 15th

0-1023

(2^10)-1

52377.6us

 

Cisco switches monitor various collision counters, as follows:

  • Single
  • Multiple
  • Late
  • Excessive

Of the four types, be wary of late and excessive collisions. Late collisions occur when two devices send data at the same time. Unlike single and multiple collisions, late collisions cause packets to be lost. Late collisions are usually indicative of the cable exceeding IEEE specifications. Cascading hubs (connecting two or more hubs to each other) can also cause the length of the collision domain to increase above specification. You can use a Time Delay Reflectometer (TDR) to detect cable fault and whether the cable is within the IEEE standard. Other factors that cause late collisions include mismatched duplex settings and bad transceivers. Example 1-1 shows the output from a switch that has detected a late collision on one of its ports.

Example 1-1. Late Collision Error Messages

 

%LANCE-5-LATECOLL: Unit [DEC], late collision error

 

%PQUICC-5-LATECOLL: Unit [DEC], late collision error

 

 

The slot time, 51.2 microseconds, used to detect and report collisions is based on the round trip time between the furthest points on the Ethernet link. The value is calculated by taking the smallest Ethernet frame size of 64 bytes and multiplying it by 8 bits, which gives 512 bits. This number is then multiplied by .1 microseconds. The farthest distance between the end points of the cable should be reached within half of this slot time, 25.6 microseconds.

Excessive collisions typically occur when too much traffic is on the wire or too many devices are in the collision domain. After the fifteenth retransmission plus the original attempt, the excessive collisions counter increments, and the packet gets dropped. In this case, too many devices are competing for the wire. In addition, duplex mismatches can also cause the problem. A syslog message is generated by the switch, as depicted in Example 1-2, when excessive collision occurs on the port.

Example 1-2. Excessive Collisions Error Message

 

%PQUICC-5-COLL: Unit [DEC], excessive collisions. Retry limit [DEC] exceeded

 

 

On the switch, the show port mod/port command provides information about collisions, multiple collisions, and so on. Example 1-3 is an excerpt from the show port command that is useful. This example was taken from a switch that was running Catalyst OS software.

Example 1-3. Sample of show port Command

 

Switch1 (enable) show port 10/3

 

 

 

Port Single-Col Multi-Coll Late-Coll Excess-Col Carri-Sen Runts Giants

 

—– ———- ———- ———- ———- ——— ——— ———

 

10/3 37 3 24 0 0 0 0

 

 

Full-Duplex Ethernet

In the party line scenario, congestion occurs when more than two people attempt to talk at the same time. When only two people are talking, or only two devices, virtually all the bandwidth is available. In cases where only two devices need to communicate, Ethernet can be configured to operate in full-duplex mode as opposed to the normal half-duplex operation. Full-duplex operation allows a network device to “talk" or transmit and “listen" or receive at the same time. (See Figure 1-5.)

Figure 1-5. Full-Duplex Directly Connected Hosts


 

Because Ethernet is based on CSMA/CD, full-duplex devices either need to be directly connected to each other or be connected to a device that allows full-duplex operation (such as a LAN switch). Ethernet hubs do not allow full-duplex operation, as they are only physical layer (Layer 1) signal repeaters for the logical bus (Layer 2). Ethernet still operates as a logical bus under full duplex.

Autonegotiation

Autonegotiation is a mechanism that allows two devices at either end to negotiate speed and duplex settings at physical layer. The benefits of autonegotiation include minimal configuration and operability between dissimilar Ethernet technologies.

In today’s networks, 10BASE-T and 100BASE-T are ubiquitous. Newer Cisco modules such as the WS-X6548-GE-TX have ports capable of 10/100/1000BASE-T. Most existing network interface cards (NICs) operate at 10/100 speeds, with newer NICs offering 10/100/1000BASE-T operation. NICs capable of autonegotiating speed and duplex are beneficial because more and more users are becoming mobile. One day, a user might be connected to the office Catalyst switch at 100 Mbps, and the next day, a remote site that supports only 10 Mbps. The primary objective is to ensure that the user not only has easy access to the network but also has network reliability. If the user’s laptop NIC is hard coded at 100BASE-T full duplex, the user connectivity might be impacted because the two switches might have different types of modules that operate at different speeds. For instance, the module in the office building is WS-X5225 (24 port 10/100BASE-TX), and the remote site has WS-X5013 (24 port 10BASE-T). In this case, because the switches are set by default to autonegotiate, a user with a NIC hard coded to 100BASE-T full duplex will not get any connectivity. Setting up autonegotiation on both the switch and laptop gets rid of this problem. The user no longer has to worry about the laptop NIC settings because the NIC automatically negotiates the proper physical layer configuration with the end device to which it connects.

The actual mechanics behind autonegotiation are straightforward, as depicted in Figure 1-6. Autonegotiation attempts to match speed and duplex mode at the highest priority with its link partner. Since the introduction of 1000BASE-T, the priorities have been readjusted. Table 1-4 describes each priority level.

Figure 1-6. Ethernet Autonegotiation


 

Table 1-4. Autonegotiation Priority Levels

Priority

Ethernet Specification

Type of Duplex

1

1000BASE-T

Full duplex

2

1000BASE-T

Half duplex

3

100BASE-T2

Full duplex

4

100BASE-TX

Full duplex

5

100BASE-T2

Half duplex

6

100BASE-T4

7

100BASE-TX

Half duplex

8

10BASE-T

Full duplex

9

10BASE-T

Half duplex

 

The 10BASE-T specification does not include autonegotiation between devices. Autonegotiation was first introduced in IEEE 802.3u Fast Ethernet specification as an optional parameter. In a 10BASE-T environment, a single pulse, called the Normal Link Pulse (NLP), is sent every 16 ms (±8 ms) on an idle link. The NLP performs a link integrity test for 10BASE-T. When no traffic is on the link, the 10BASE-T device generates a NLP on the wire to keep the link from going down. The 10BASE-T device stops generating pulses when it receives data packets. A link failure occurs under conditions when the 10BASE-T device does not receive NLPs or a single data packet within a specified time slot.

As mentioned earlier, the IEEE 802.3u specification has an optional programmable field for autonegotiation. Within autonegotiation, there are various other optional operations, such as Remote Fault Indication and Next Page Function. Remote Fault Indication detects and informs the link partner of physical layer errors. The Next Page Function provides more verbose information about the negotiation process. One of the more appealing features of autonegotiation is compatibility with dissimilar Ethernet technologies. For example, Fast Ethernet is backward-compatible with 10BASE-T through a Parallel Detection mechanism. Essentially, the Fast Ethernet switches to NLP to communicate with a 10BASE-T device. Parallel Detection is when only one of the two link partners is capable of autonegotiation.

Fast Ethernet uses the same pulse structure as 10BASE-T. In 10BASE-T, there is only a single pulse every 16 ms, whereas in Fast Ethernet, there are bursts of pulses in intervals of 16 (±8) ms. In these pulses, or groups of pulses, the capability of the device is encoded in a 16-bit word called a Link Code Word (LCW), also known as Fast Link Pulse (FLP). The length of the burst is approximately 2 ms.

NOTE

Fast Ethernet vendors used their discretion whether to add autonegotiation capabilities to their devices. As a result, Fast Ethernet NICs without autonegotiation capabilities were once found in the marketplace.

 

Gigabit Ethernet implementation requires that all IEEE 802.3z compliant devices have autonegotiation capability. Autonegotiation can, however, be disabled through a software feature. From the actual hardware perspective, the 802.3z specification requires autonegotiation capabilities on the device. On Cisco Catalyst switches, autonegotiation can be disabled with the following command. Note that this command must be configured on both link partners:

 

 

 

 

 

set port negotiation <mod/port> enable | disable

 

 

The parameters that 802.3z devices negotiate are

  • Duplex setting
  • Flow control
  • Remote fault information

Although duplex setting can be negotiated, Cisco switches operate Gigabit Ethernet in full-duplex mode only. With the introduction of the newer 1000/100/10 blades, a port can operate at various speeds and duplex settings. However, it is unlikely that Cisco will support Gigabit half duplex in any point-to-point configurations with even the aforementioned blades. Use the show port capabilities command that is available in Catalyst OS to view the features supported by the line module, as shown in Example 1-4.

Example 1-4. Output from show port capabilities Command

 

Switch1 (enable) show port capabilities 1/1

 

Model WS-X6K-SUP2-2GE

 

Port 1/1

 

Type 1000BaseSX

 

Speed 1000

 

Duplex full

 

 

Flow control is an optional feature that is part of the 802.3x specification. The concept behind flow control is to help reduce the burden on the port that is overwhelmed with traffic. It does this by creating back-pressure on the network. If the volume of traffic is such that a port runs out of buffers, it drops subsequent packets. The flow control mechanism simply tells the transmitter to back off for a period of time by sending an Ethernet Pause Frame (MAC address of 01-80-c2-00-00-01) to the transmitter. The transmitter receives this frame and buffers the outgoing packets in its output buffer queue. This mechanism provides needed time for the receiver to clear the packets that are in its input queue. The obvious advantage is that packets are not dropped. The negative aspect to this process is latency. Certain multicast, voice, and video traffic are sensitive to latency on the network. It is recommended that flow control should be implemented with care. Typically, this feature is implemented as a quick fix. Not all Cisco switches support this feature.

 

 

 

 

 

set port flowcontrol <mod/port>

 

 

Remote fault information detects and advertises physical layer problems such as excessive noise, wrong cable types, bad hardware, and so on to the remote peer. The switch is programmed to take a proactive approach when excessive physical layer problems exist. A port that is generating errors can potentially disrupt a network. For instance, it can cause spanning-tree problems and traffic black holing, and drain system resources. As a result, the switch error disables the port.

Looking at some examples will solidify the concept and function of autonegotiation. In Figure 1-7, Host1 and the hub are link partners over a 10BASE-T connection. 10BASE-T has no knowledge of autonegotiation, and therefore, the devices must statically be configured. NLPs are sent by both devices when they come online. In this example, these devices operate over a 10BASE-T half-duplex connection.

Figure 1-7. 10BASE-T Autonegotiation


 

Figure 1-8 shows a straight 100BASE-T connection with both devices enabled for autonegotiation. FLP bursts are sent to advertise the device’s capabilities and negotiate a maximum highest bandwidth connection. The highest connection negotiated is priority 4, which is 100BASE-TX full duplex.

Figure 1-8. 100BASE-T Autonegotiation


 

The following is the command that configures a switch to autonegotiate a port:

 

 

 

 

 

set port speed <mod/port> auto

 

 

In Figure 1-9, Host1 has a 10BASE-T card. The switch has a capability to operate in both 10BASE-T and 100BASE-T mode. The 10/100 modules are common in a switching environment. Cisco has various 10/100 modules with various features and functionalities. In this example, there is a mismatch between the pulses sent by the Host1 and the switch. Because Host1 has a 10BASE-T card, it can send only NLPs. Initially, when the switch comes online, it generates only FLP bursts. When the switch detects NLPs from its link partner, it ceases to generate FLP bursts and switches to NLP. Depending on the static configuration on Host1, the switch chooses that priority. In this instance, the connection is 10BASE-T operating at half duplex.

Figure 1-9. 10/100BASE-T Autonegotiation


 

The finer points of autonegotiation have been discussed; however, some drawbacks need to be discussed. Numerous network problems resulted when the autonegotiation feature was first deployed. The issues ranged from degradation in performance to connectivity loss. The cause of some of these problems included advanced software features that came with the NIC, vendors not fully conforming to 802.3u standard, and buggy code. These days, now that manufacturers have resolved these issues, misconfiguration is the biggest remaining problem. Table 1-5 and Table 1-6 show various consequences from misconfigurations. For instance, a duplex mismatch can degrade performance on the wire and potentially cause packet loss.

Table 1-5. Autonegotiation Configurations for 10/100 Ethernet

Configuration NIC (Speed/Duplex)

Configuration Switch (Speed/Duplex)

Resulting NIC Speed/Duplex

Resulting Catalyst Speed/Duplex

Comments

AUTO

AUTO

100 Mbps, Full duplex

100 Mbps, Full duplex

Assuming maximum capability of Catalyst switch and NIC is 100 full duplex.

100 Mbps, Full duplex

AUTO

100 Mbps, Full duplex

100 Mbps, Half duplex

Duplex mismatch.

AUTO

100 Mbps, Full duplex

100 Mbps, Half duplex

100 Mbps, Full duplex

Duplex mismatch.

100 Mbps, Full duplex

100 Mbps, Full duplex

100 Mbps, Full duplex

100 Mbps, Full duplex

Correct manual configuration.

100 Mbps, Half duplex

AUTO

100 Mbps, Half duplex

100 Mbps, Half duplex

Link is established, but switch does not see any autonegotiation information from NIC and defaults to half duplex.

10 Mbps, Half duplex

AUTO

10 Mbps, Half duplex

10 Mbps, Half duplex

Link is established, but switch will not see FLP and will default to 10 Mbps half duplex.

10 Mbps, Half duplex

100 Mbps, Half duplex

No Link

No Link

Neither side will establish link because of speed mismatch.

AUTO

100 Mbps, Half duplex

10 Mbps, Half duplex

10 Mbps, Half duplex

Link is established, but NIC will not see FLP and default to 10 Mbps half duplex.

 

Table 1-6. Autonegotiations Configurations for Gigabit Ethernet

Switch Port Gigabit

Autonegotiation Setting

NIC Gigabit Autonegotiation Setting

Switch Link/NIC Link

Enabled

Enabled

Up

Up

Disabled

Disabled

Up

Up

Enabled

Disabled

Down

Up

Disabled

Enabled

Up

Down

 

Network engineers still have heated discussions about whether to enable autonegotiation in the network. As mentioned earlier, autonegotiation is a big advantage for mobile users. A user should not have to worry about configuring his laptop every time he goes to a different location.

The rule of thumb is to enable autonegotiation on access ports that connect to users. Mission-critical devices should be statically configured to protect the network from possible outages and performance hits. Therefore, connections between routers and switches, or servers and switches should be hard coded with the appropriate speed and duplex settings.

Switch Congestion and Head-of-Line Blocking

Congestion and Head-of-Line Blocking

Head-of-line blocking occurs whenever traffic waiting to be transmitted prevents or blocks traffic destined elsewhere from being transmitted. Head-of-line blocking occurs most often when multiple high-speed data sources are sending to the same destination. In the earlier shared bus example, the central arbiter used the round-robin service approach to moving traffic from one line card to another. Ports on each line card request access to transmit via a local arbiter. In turn, each line card’s local arbiter waits its turn for the central arbiter to grant access to the switching bus. Once access is granted to the transmitting line card, the central arbiter has to wait for the receiving line card to fully receive the frames before servicing the next request in line. The situation is not much different than needing to make a simple deposit at a bank having one teller and many lines, while the person being helped is conducting a complex transaction.

In Figure 2-7, a congestion scenario is created using a traffic generator. Port 1 on the traffic generator is connected to Port 1 on the switch, generating traffic at a 50 percent rate, destined for both Ports 3 and 4. Port 2 on the traffic generator is connected to Port 2 on the switch, generating traffic at a 100 percent rate, destined for only Port 4. This situation creates congestion for traffic destined to be forwarded by Port 4 on the switch because traffic equal to 150 percent of the forwarding capabilities of that port is being sent. Without proper buffering and forwarding algorithms, traffic destined to be transmitted by Port 3 on the switch may have to wait until the congestion on Port 4 clears.

Figure 2-7. Head-of-Line Blocking


 

Head-of-line blocking can also be experienced with crossbar switch fabrics because many, if not all, line cards have high-speed connections into the switch fabric. Multiple line cards may attempt to create a connection to a line card that is already busy and must wait for the receiving line card to become free before transmitting. In this case, data destined for a different line card that is not busy is blocked by the frames at the head of the line.

Catalyst switches use a number of techniques to prevent head-of-line blocking; one important example is the use of per port buffering. Each port maintains a small ingress buffer and a larger egress buffer. Larger output buffers (64 Kb to 512 k shared) allow frames to be queued for transmit during periods of congestion. During normal operations, only a small input queue is necessary because the switching bus is servicing frames at a very high speed. In addition to queuing during congestion, many models of Catalyst switches are capable of separating frames into different input and output queues, providing preferential treatment or priority queuing for sensitive traffic such as voice. Chapter 8 will discuss queuing in greater detail.

Swich Data Switch fabric

Although a variety of techniques have been used to implement switching fabrics on Cisco Catalyst platforms, two major architectures of switch fabrics are common:

  • Shared bus
  • Crossbar

Shared Bus Switching

In a shared bus architecture, all line modules in the switch share one data path. A central arbiter determines how and when to grant requests for access to the bus from each line card. Various methods of achieving fairness can be used by the arbiter depending on the configuration of the switch. A shared bus architecture is much like multiple lines at an airport ticket counter, with only one ticketing agent processing customers at any given time.

Figure 2-2 illustrates a round-robin servicing of frames as they enter a switch. Round-robin is the simplest method of servicing frames in the order in which they are received. Current Catalyst switching platforms such as the Catalyst 6500 support a variety of quality of service (QoS) features to provide priority service to specified traffic flows. Chapter 8, “Understanding Quality of Service on Catalyst 6500," will provide more information on this topic.

Figure 2-2. Round-Robin Service Order


 

The following list and Figure 2-3 illustrate the basic concept of moving frames from the received port or ingress, to the transmit port(s) or egress using a shared bus architecture:

1.Frame received from Host1? The ingress port on the switch receives the entire frame from Host1 and stores it in a receive buffer. The port checks the frame’s Frame Check Sequence (FCS) for errors. If the frame is defective (runt, fragment, invalid CRC, or Giant), the port discards the frame and increments the appropriate counter.

2.Requesting access to the data bus? A header containing information necessary to make a forwarding decision is added to the frame. The line card then requests access or permission to transmit the frame onto the data bus.

3.Frame transmitted onto the data bus? After the central arbiter grants access, the frame is transmitted onto the data bus.

4.Frame is received by all ports? In a shared bus architecture, every frame transmitted is received by all ports simultaneously. In addition, the frame is received by the hardware necessary to make a forwarding decision

5.Switch determines which port(s) should transmit the frame? The information added to the frame in step 2 is used to determine which ports should transmit the frame. In some cases, frames with either an unknown destination MAC address or a broadcast frame, the switch will transmit the frame out all ports except the one on which the frame was received.

6.Port(s) instructed to transmit, remaining ports discard the frame? Based on the decision in step 5, a certain port or ports is told to transmit the frame while the rest are told to discard or flush the frame.

7.Egress port transmits the frame to Host2? In this example, it is assumed that the location of Host2 is known to the switch and only the port connecting to Host2 transmits the frame

 

Figure 2-3. Frame Flow in a Shared Bus

[View full size image]


 

One advantage of a shared bus architecture is every port except the ingress port receives a copy of the frame automatically, easily enabling multicast and broadcast traffic without the need to replicate the frames for each port. This example is greatly simplified and will be discussed in detail for Catalyst platforms that utilize a shared bus architecture in Chapter 3, “Catalyst Switching Architecture."

Crossbar Switching

In the shared bus architecture example, the speed of the shared data bus determines much of the overall traffic handling capacity of the switch. Because the bus is shared, line cards must wait their turns to communicate, and this limits overall bandwidth.

A solution to the limitations imposed by the shared bus architecture is the implementation of a crossbar switch fabric, as shown in Figure 2-4. The term crossbar means different things on different switch platforms, but essentially indicates multiple data channels or paths between line cards that can be used simultaneously.

Figure 2-4. Crossbar Switch Fabric


 

In the case of the Cisco Catalyst 5500 series, one of the first crossbar architectures advertised by Cisco, three individual 1.2-Gbps data buses are implemented. Newer Catalyst 5500 series line cards have the necessary connector pins to connect to all three buses simultaneously, taking advantage of 3.6 Gbps of aggregate bandwidth. Legacy line cards from the Catalyst 5000 are still compatible with the Catalyst 5500 series by connecting to only one of the three data buses. Access to all three buses is required by Gigabit Ethernet cards on the Catalyst 5500 platform.

A crossbar fabric on the Catalyst 6500 series is enabled with the Switch Fabric Module (SFM) and Switch Fabric Module 2 (SFM2). The SFM provides 128 Gbps of bandwidth (256 Gbps full duplex) to line cards via 16 individual 8-Gbps connections to the crossbar switch fabric. The SFM2 was introduced to support the Catalyst 6513 13-slot chassis and includes architecture optimizations over the SFM.

LanSwitch Receive Data Mode

Cut-Through Mode

Switches operating in cut-through mode receive and examine only the first 6 bytes of a frame. These first 6 bytes represent the destination MAC address of the frame, which is sufficient information to make a forwarding decision. Although cut-through switching offers the least latency when transmitting frames, it is susceptible to transmitting fragments created via Ethernet collisions, runts (frames less than 64 bytes), or damaged frames.

Fragment-Free Mode

Switches operating in fragment-free mode receive and examine the first 64 bytes of frame. Fragment free is referred to as “fast forward" mode in some Cisco Catalyst documentation. Why examine 64 bytes? In a properly designed Ethernet network, collision fragments must be detected in the first 64 bytes.

Store-and-Forward Mode

Switches operating in store-and-forward mode receive and examine the entire frame, resulting in the most error-free type of switching.

As switches utilizing faster processor and application-specific integrated circuits (ASICs) were introduced, the need to support cut-through and fragment-free switching was no longer necessary. As a result, all new Cisco Catalyst switches utilize store-and-forward switching.

Figure 2-1 compares each of the switching modes.

Figure 2-1. Switching Modes


802.1D TOPOLGY CHANGE FROM CISCO

Interactive: This document offers customized analysis of your Cisco device.


Contents

Introduction

Prerequisites

      Requirements

      Components Used

      Conventions

Purpose of the Topology Change Mechanism

Principle of Operation

      Notify the Root Bridge

      Broadcast the Event to the Network

What to Do When There are Many Topology Changes in the Network

      Flooded Traffic

      Problem in ATM LANE Bridged Environments

      Avoid TCN Generation with the portfast Command
      Track the Source of a TCN

Conclusion

NetPro Discussion Forums – Featured Conversations

Related Information


Introduction

When you monitor
Spanning-Tree Protocol (STP) operations, you may be concerned when you see topology change counters incrementing in the statistics log. Topology changes are normal in STP. However, too many of them can have an impact on network performances. This document explains that the purpose of this topology is to:

  • Change the mechanism in per-VLAN spanning tree (PVST) and PVST+ environments.
  • Determine what triggers a topology change event.
  • Describe issues related to the topology change mechanism.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

Purpose of the Topology Change Mechanism

Learning from the frames it receives, a bridge creates a table that associates to a port the Media Access Control (MAC) addresses of the hosts that can be reached through this port. This table is used to forward frames directly to their destination port. Therefore, flooding is avoided.

Default aging time for this table is 300 seconds (five minutes). Only after a host has been silent for five minutes, its entry disappears from the table of the bridge. Here is an example that shows why you could want this aging to be faster:

In this network, assume that bridge B1 is blocking its link to B4. A and B are two stations that have an established connection. Traffic from A to B goes to B1, B2, B3, and then B4. The scheme shows the MAC addresses table learned by the four bridges in this situation:


Now, assume the link between B2 and B3 fails. Communication between A and B is interrupted at least until B1 puts its port to B4 in forwarding mode (a maximum of 50 seconds with default parameters). However, when A wants to send a frame to B, B1 still has an entry that leads to B2 and the packet is sent to a black hole. The same applies when B wants to reach A. Communication is lost for five minutes, until the entries for A and B MAC addresses age out.


The forwarding databases implemented by bridges are very efficient in a stable network. However, there are many situations where the five minute aging time is a problem after the topology of the network has changed. The topology change mechanism is a workaround for that kind of problem. As soon as a bridge detects a change in the topology of the network (a link that goes down or goes to forwarding), it advertises the event to the whole bridged network.

The Principle of Operation section explains how this is practically implemented. Every bridge is then notified and reduces the aging time to forward_delay (15 seconds by default) for a certain period of time (max_age + forward_delay). It is more beneficial to reduce the aging time instead of clearing the table because currently active hosts, that effectively transmit traffic, are not cleared from the table.

In this example, as soon as bridge B2 or B3 detects the link going down, it sends topology change notifications. All bridges become aware of the event and reduce their aging time to 15 seconds. As B1 does not receive any packet from B on its port leading to B2 in fifteen seconds, it ages out the entry for B on this port. The same happens to the entry for A on the port that leads to B3 on B4. Later when the link between B1 and B4 goes to forwarding, traffic is immediately flooded and re-learned on this link.

Principle of Operation

This section explains how a bridge advertises a topology change at the Bridge Protocol Data Unit (BPDU) level. .

It has already been briefly explained when a bridge considers it detected a topology change. The exact definition is:

  • When a port that was forwarding is going down (blocking for instance).
  • When a port transitions to forwarding and the bridge has a designated port. (This means that the bridge is not standalone.)

The process to send a notification to all bridges in the network involves two steps:

  • The bridge notifies the root bridge of the spanning tree.
  • The root bridge “broadcasts" the information into the whole network.

Notify the Root Bridge

In normal STP operation, a bridge keeps receiving configuration BPDUs from the root bridge on its root port. However, it never sends out a BPDU toward the root bridge. In order to achieve that, a special BPDU called the topology change notification (TCN) BPDU has been introduced. Therefore, when a bridge needs to signal a topology change, it starts to send TCNs on its root port. The designated bridge receives the TCN, acknowledges it, and generates another one for its own root port. The process continues until the TCN hits the root bridge.


The TCN is a very simple BPDU that contains absolutely no information that a bridge sends out every hello_time seconds (this is locally configured hello_time, not the hello_time specified in configuration BPDUs). The designated bridge acknowledges the TCN by immediately sending back a normal configuration BPDU with the topology change acknowledgement (TCA) bit set. The bridge that notifies the topology change does not stop sending its TCN until the designated bridge has acknowledged it. Therefore, the designated bridge answers the TCN even though it does not receive configuration BPDU from its root.

Broadcast the Event to the Network

Once the root is aware that there has been a topology change event in the network, it starts to send out its configuration BPDUs with the topology change (TC) bit set. These BPDUs are relayed by every bridge in the network with this bit set. As a result all bridges become aware of the topology change situation and it can reduce its aging time to forward_delay. Bridges receive topology change BPDUs on both forwarding and blocking ports.

The TC bit is set by the root for a period of max_age + forward_delay seconds, which is 20+15=35 seconds by default.


What to Do When There are Many Topology Changes in the Network

Here are some of the problems that can be generated by TCN. It is followed by some information on how to limit topology changes and find from where they come .

If you have the output of a show-tech support command from your Cisco device, you can use Output Interpreter (
registered customers only
) to display potential issues and fixes. To use Output Interpreter (
registered customers only
) , you must be a registered customer, be logged in, and have JavaScript enabled.

Flooded Traffic

The more hosts are in the network, the higher are the probabilities of getting a topology change. For instance, a directly attached host triggers a topology change when it is power cycled. In very large (and flat) networks, a point can be reached where the network is perpetually in a topology change status. This is as if the aging time is configured to fifteen seconds, which leads to a high level of flooding. Here is a worst case scenario that happened to a customer who was doing some server backup.


The aging out of the entry for the device that receives the backup was a disaster because it caused a very heavy traffic to hit all users. See the Avoid TCN Generation with the portfast Command section for how to avoid TCN generation.

Problem in ATM LANE Bridged Environments

This case is more critical than the normal flooding of traffic implied by a quick aging. On the receipt of a topology change for a VLAN, a Catalyst switch has its LAN emulation (LANE) blades reconfirming their LE-arp table for the corresponding emulated LAN (ELAN). As every LANE blade in the ELAN issues at the same time the same request, it may put a high stress on the LAN Emulation Server (LES) if there are a lot of entries to reconfirm. Connectivity issues have been seen in this scenario. If the network is sensitive to a topology change, the real problem is not the topology change itself but the design of the network. It is recommended that you limit as much as possible the TCN generation to save the CPU of the LES (at least). See the Avoid TCN Generation with the portfast Command section to limit TCN generation.

Avoid TCN Generation with the portfast Command

The portfast feature is a Cisco proprietary change in the STP implementation. The command is applied to specific ports and has two effects:

  • Ports that come up are put directly in the forwarding STP mode, instead of going through the learning and listening process. The STP still runs on ports with portfast.
  • The switch never generates a TCN when a port configured for portfast is going up or down.

Enable portfast on ports where the connected hosts are very likely to bring their link up and down (typically end stations that users frequently power cycle). This feature should not be necessary for server ports. It should definitely be avoided on ports that lead to hubs or other bridges. A port that directly transitions to forwarding state on a redundant link can cause temporary bridging loops.

Topology changes can be useful, so do not enable portfast on a port for which a link that goes up or down is a significant event for the network.

Track the Source of a TCN

In itself, a topology change notification is not a bad thing, but as a good network administrator, it is better to know their origin in order to be sure that they are not related to a real problem. Identifying the bridge that issued the topology change is not an easy task. However, it is not technically complex.

Most bridges only count the number of TCNs they have issued or received. The Catalyst 4500/4000, 5500/5000, and 6500/6000 are able to show the port and the ID of the bridge that sent the last topology change they received. Starting from the root, it is then possible to go downstream to the initiator bridge. Refer to the show spantree statistics
command for more information.

If you have the output of a show spantree statistics command from your Cisco device, use Output Interpreter (
registered customers only
) to display potential issues and fixes. To use Output Interpreter (
registered customers only
) , you must login as a registered customer, and have JavaScript enabled.

IEEE 802.1

IEEE 802.1

目錄

零、IEEE 802.1簡介

一、IEEE 802.1D

二、IEEE 802.1p協議

三、IEEE 802.1q協議

四、IEEE 802.1w協議

五、IEEE 802.1s協議

六、IEEE 802.1x協議

展開

零、IEEE 802.1簡介

一、IEEE 802.1D

二、IEEE 802.1p協議

三、IEEE 802.1q協議

四、IEEE 802.1w協議

五、IEEE 802.1s協議

六、IEEE 802.1x協議

展開

編輯本段零、IEEE 802.1簡介

  IEEE 802.1是一組協定的集合,如生成樹協議、VLAN協議等。為了將各個協議區別開來,IEEE在制定某一個協議時,就在IEEE 802.1後面加上不同的小寫字母,
如IEEE 802.1a定義局域網體系結構;IEEE 802.1b定義網際互連,網路管理及定址;IEEE 802.1d定義生成樹協議;IEEE 802.1p定義優先順序佇列
IEEE 802.1q定義VLAN標記協定;IEE 802.1s定義多生成樹協議;IEEE 802.1w定義快速生成樹協議;IEEE 802.1x定義局域網安全認證等。

編輯本段一、IEEE 802.1D


 

1IEEE 802.1D簡介

  為了解決"廣播風暴“這一在二層資料網路中存在弊端,IEEE(電機和電子工程師學會)制定了IEEE 802.1d的生成樹(Spanning Tree)協議。生成樹協議是一種鏈路管理協定,為網路提供路徑冗餘,同時防止產生環路。為使乙太網更好地工作,兩個工作站之間只能有一條活動路徑。

  STP(生成樹協議)允許橋接器之間相互通信以發現網路物理環路。該協定定義了一種演算法,橋接器能夠使用它創建無環路(loop-free)的邏輯拓樸結構。換句話說,STP創建了一個由無環路樹葉和樹枝構成的樹結構,其跨越了整個第二層網路。


 

2、工作原理

  STP協議中定義了根橋(Root Bridge)、根埠(Root Port)、指定埠(Designated Port)、路徑開銷(Path Cost)等概念,目的就在於通過構造一棵自然樹的方法達到裁剪冗餘環路的目的,
同時實現鏈路備份和路徑最優化。用於構造這棵樹的演算法稱為生成樹演算法 SPA。
要實現這些功能,橋接器之間必須要進行一些資訊的交流,這些資訊交流單元就稱為配置消息BPDU。STP BPDU是一種二層資訊,目的MAC是多播地址01-80-C2-00-00-00,
所有支援STP協定的橋接器都會接收並處理收到的BPDU報文。該報文的資料區裡攜帶了用於生成樹計算的所有有用資訊。

  STP的主要不足表現在:二層數據網的收斂時間過長;網路拓撲容易引起全域波動;缺乏對現有多 VLAN 環境的支持。

編輯本段二、IEEE 802.1p協議

  IEEE 802.1P是流量優先權控制標準,工作在媒體存取控制(MAC)子層,使得二層交換機能夠提供流量優先順序和動態組播過濾服務。
IEEE 802.1p標準也提供了組播流量過濾功能,以確保該流量不超出第二層切換式網路範圍。 IEEE 802.1p協議頭包括一個3位元優先順序欄位,
該欄位支持將數據包分組為各種流量種類。它是IEEE 802.1q(VLAN標籤協定)標準的擴充協定,它們協同工作
IEEE 802.1q標準定義了為乙太網MAC幀添加的標籤。VLAN 標籤有兩部分:VLAN ID(12位元)和優先順序(3位元)。IEEE 802.1q VLAN標準中沒有定義和使用優先順序欄位,而IEEE
802.1p中則定義了該欄位。

  IEEE 802.1p中定義的優先順序有8種。最高優先順序為7,應用於關鍵性網路流量;優先順序6和5主要用於延遲敏感(delay-sensitive)應用程式;優先順序4到1主要用於受控負載(controlled-load)應用程式;優先順序0是預設值,在沒有設置其它優先順序值的情況下自動啟用。

編輯本段三、IEEE 802.1q協議

  IEEE 802.1q協議也就是"Virtual Bridged Local Area Networks"(虛擬橋接局域網,簡稱"虛擬區域網路“)協議,主要規定了VLAN的實現方法。

1VLAN簡介

  "Virtual LANs"(虛擬區域網路)目前發展很快,世界上主要的大網路廠商在他們的交換機設備中都實現了VLAN協議。在一個支援VLAN技術的交換機中,
可以將它的乙太網口劃分為幾個組,比如生產組、工程組、市場組等。這樣,組內的各個用戶就像在同一個局域網內(可能各組的用戶位於很多的交換機上,而非一個交換機)一樣,
同時,不是本組的用戶就無法訪問本組的成員,在一定程度上提高了各組的網路安全性。

  VLAN成員的定義可以分為4種,即根據埠劃分VLAN;根據MAC位址劃分VLAN;根據網路層劃分VLAN;根據IP組播劃分。

2、協議簡介

  IEEE 802.1q協定為標識帶有VLAN成員資訊的乙太訊框建立了一種標準方法。IEEE802.1q標準定義了VLAN橋接器操作,從而允許在橋接局域網結構中實現定義、運行以及管理VLAN拓撲結構 等操作。IEEE 802.1q標準主要用來解決如何將大型網路劃分為多個小網路,如此廣播和組播流量就不會佔據更多頻寬的問題。此外IEEE 802.1q標準還提供更高的網路段間安全性。IEEE802.1q完成這些功能的關鍵在於標籤。支援IEEE 802.1q的交換埠可被配置來傳輸標籤乙太訊框無標籤乙太訊框。一個包含VLAN資訊的標籤欄位可以插入到乙太訊框中。如果埠有支援IEEE 802.1q的設備(如另一個交換機)相連,那麼這些標籤幀可以在交換機之間傳送VLAN成員資訊,這樣VLAN就可以跨越多台交換機。但是,對於沒有支援IEEE 802.1q設備相連的埠我們必須確保它們用於傳輸無標籤幀。

  在IEEE 802.1q中,用於標籤幀的最大合法乙太訊框大小已由1518位元組增加到1522位元組,這樣就會使網卡和舊式交換機由於幀"尺寸過大"而丟棄標籤乙太訊框。

編輯本段四、IEEE 802.1w協議

  為了解決前面介紹的STP協議缺陷,在20世紀初IEEE推出了802.1w標準。它同樣是屬於生成樹協議類型,稱之為"快速生成樹協議",作為對802.1D標準的補充。之所以要制定IEEE 802.1w協議的原因是IEEE 802.1d協議雖然解決了鏈路閉合引起的閉環問題,但是生成樹的收斂(過程仍需比較長的時間。

1、協議原理

  IEEE 802.1w RSTP的特點是將許多思科增值生成樹擴展特性融入原始IEEE 802.1d中,如Portfast、Uplinkfast和Backbonefast。IEEE 802.1w協議通過利用一種主動的橋接器到橋接器握手機制,取代 IEEE 802.1d根橋接器中定義的計時器功能,提供了交換機(橋接器)、交換機埠(橋接器埠)或整個LAN的快速故障恢復功能。

  RSTP協定在STP協定基礎上做了以下兩個重要改進,使得收斂速度快得多(最快1秒以內) 。

  IEEE 802.1w設置了快速切換用的替代埠(Alternate Port)和備份埠(Backup Port)兩種角色,當根埠/指定埠失效的情況下,替代埠/備份埠就會無時延地進入轉發狀態。

  減少轉發延時

  使用了RSTP協定後,在只連接了兩個交換埠的點對點鏈路中,指定埠只需與下游橋接器進行一次握手就可以無時延地進入轉發狀態。

2IEEE 802.1w標準的缺陷

  RSTP的主要缺陷表現在以下三個方面:

  由於整個切換式網路只有一棵生成樹,在網路規模比較大的時候會導致較長的收斂時間,拓撲改變的影響面也較大。

  在網路結構不對稱的時候, RSTP協定的單生成樹就會影響網路的連通性。

  當鏈路被阻塞後將不承載任何流量,造成了頻寬的極大浪費,這在環行都會區網路的情況下比較明顯。

編輯本段五、IEEE 802.1s協議

  IEEE 802.1s標準中的多生成樹(MSTP)技術把IEEE 802.1w快速單生成樹(RSTP)演算法擴展到多生成樹,這為虛擬區域網路(VLANs)環境提供了快速收斂和負載均衡的功能,是IEEE 802.1 VLAN標記協定的擴展協定。

1MSTP工作原理

  IEEE802.1s引入了IST(Single Spanning Tree,單生成樹)概念和MST實例。IST是一種RSTP實例,它擴展了MST區域內的802.1D單一生成樹。IST連接所有MST橋接器,並從邊界埠發出、作為貫穿整個橋接器域的虛擬橋接器。MST實例(MSTI)是一種僅存在於區域內部的RSTP實例。它可以缺省運行RSTP,無須額外配置。不同於IST的是,MSTI在區域外既不與BPDU交互,也不發送BPDU。MSTP可以與傳統和PVST+交換機交互操作。

  採用MSTP技術,可以通過幹道(trunks)建立多個生成樹,關聯VLANs到相關的生成樹進程,而且每個生成樹進程具有獨立於其它進程的拓撲結構。MSTP還提供了多個資料轉發路徑和負載均衡,提高了網路容錯能力,因為一個進程(轉發路徑)的故障不會影響其它進程(轉發路徑)。

  每台運行MST的交換機都擁有單一配置,包括一個字母數位式配置名、一個配置修訂號和一個4096部件表,與潛在支援某個實例的各4096 VLAN相關聯。作為公共MSTP區域的一部分,一組交換機必須共用相同的配置屬性。重要的是要記住,配置屬性不同的交換機會被視為位於不同的區域。

2MSTP的主要特性

  MSTP具有下列特性:

  MSTP在MSTP區中運行IST常量;

  一個運行MSTP的橋提供與單生成樹橋的互通性;

  MSTP在每個區內建立和維護額外的生成樹。

編輯本段六、IEEE 802.1x協議

  IEEE 802.1x也稱為"基於埠的存取控制協議"(Port based network access control protocol)。它的體系結構包括三個重要的部分:Supplicant System(用戶端系統)、Authenticator System(認證系統)、Authentication Server System(認證伺服器系統)。

  "用戶端系統"一般為一個使用者終端系統。該終端系統通常要安裝一個用戶端軟體,使用者通過啟動這個用戶端軟體發起IEEE 802.1x協定的認證過程。

  "認證系統"通常為支援IEEE 802.1x協定的網路設備。該設備對應於不同使用者的埠有兩個邏輯埠:受控(controlled Port)埠和不受控埠(uncontrolled Port)。

  "認證伺服器系統"通常為RADIUS伺服器,該伺服器可以存儲有關使用者的資訊,比如使用者所屬的VLAN、CAR參數、優先順序、用戶的存取控制清單等等

IEEE 802.1S and Cisco MSTI

IEEE 802.1s協議
IEEE 802.1s標準中的多生成樹(Multiple Spanning Tree ,MST)技術把IEEE 802.1w快速單生成樹(RST)演算法擴展到多生成樹,這為虛擬區域網路(VLANs)環境提供了快速收斂和負載均衡的功能,是IEEE 802.1 VLAN標記協定的擴展協定。
1.MST工作原理

IEEE802.1s引入了IST(Single Spanning Tree,單生成樹)概念和MST實例。IST是一種RSTP實例,它擴展了MST區域內的802.1D單一生成樹。IST連接所有MST橋接器接器,並從邊界埠發出、作為貫穿整個橋接器接器域的虛擬橋接器接器。MST實例(MSTI)是一種僅存在於區域內部的RSTP實例。它可以預設運行RSTP,無須額外配置。不同於IST的是,MSTI在區域外既不與BPDU交互,也不發送BPDU。MST可以與傳統的PVST+交換機交互操作。思科實施定義了16種實例:一個IST(實例0)和15個MSTI,而IEEE 802.1s則支持一個IST和63個MSTI。
RSTP和MSTP都能夠與傳統生成樹協議交互操作。但是,當與傳統橋接器接器交互時,IEEE 802.1w的快速融合優勢就會失去。為保留與基於IEEE 802.1d橋接器接器的向後相容性,IEEE 802.1s協議橋接器接器在其埠上接聽IEEE 802.1d格式的BPDU(橋接器接器協定資料單元)。如果收到了IEEE 802.1d BPDU,埠會採用標準IEEE 802.1d行為,以確保相容性。
採用MST技術後,可以通過幹道(trunks)建立多個生成樹,關聯VLANs到相關的生成樹進程,而且每個生成樹進程具有獨立於其他進程的拓撲結構。MST還提供了多個資料轉發路徑和負載均衡,提高了網路容錯能力,因為一個進程(轉發路徑)的故障不會影響其他進程(轉發路徑)。
每台運行MST的交換機都擁有單一配置,包括一個字母數位式配置名、一個配置修訂號和一個4096部件表,與潛在支援某個實例的各4096 VLAN相關聯。作為公共MST區域的一部分,一組交換機必須共用相同的配置屬性。重要的是要記住,配置屬性不同的交換機會被視為位於不同的區域。
在大型網路的不同網路部分,通過MST來定位不同VLANs和生成樹進程的分配可以更容易地管理網路和使用冗餘路徑;一個生成樹進程只能存在於具有一致的VLAN進程分配的橋接器中,必須用同樣的MST配置資訊來配置一組橋接器,這使得這些橋接器能參與到一組生成樹進程中,具有同樣的MST配置資訊的互連的橋接器構成多生成樹(MST)區。
為確保一致的VLAN實例映射,協定需要識別區域的邊界。因此,區域的特徵都包括在BPDU中。交換機必須瞭解它們是否像鄰居一樣位於同一區域,因此會發送一份VLAN實例映射表摘要,以及修訂號和名稱。當交換機接收到BPDU後,它會提取摘要,並將其與自身的計算結果進行比較。為避免出現生成樹環路,如果兩台交換機在BPDU中所接收的參數不一致,負責接收BPDU的埠就會被宣佈為邊界埠。

2.MST的主要特性
多生成樹(MST)使用修正的快速生成樹協定(RSTP)——多生成樹協議(MSTP)。MST具有下列特性。
(1)MST在MST區中運行IST程序(instance 0)
MST協定運行一個生成樹程序叫做內部生成樹(IST),IST用於關聯MST區的內部資訊同時增加了共用
生成樹(CST)的資訊來和其它MST區域或CST溝通,而MST區對於相鄰的單一生成樹(SST)和其MST區
其本身整個MST區域就像一個單獨的橋接器接器。

(2)一個運行MST的橋接器提供與單一生成樹橋接器的互通性
在MST協議中,內部生成樹(IST)連接區中的所有MST橋接器,並且是共用生成樹(CST)的一個子樹。通用生成樹包含整個的橋接器域,MST區對於相鄰的單一生成樹(SST)橋接器和其它MST區就像一個虛橋接器。通用和內部生成樹(CIST)是每個MST區的內部生成樹(IST)、互連MST區的通用生成樹和單生成樹橋接器的一個集合,它與一個MST區內的一個IST和一個MST區外的CST都是一樣的。STP、RSTP和MSTP共同建立一個單獨的橋接器來作為通用和內部生成樹(CIST)的根。

(3)MST在每個自身區內建立和維護額外的生成樹
這些建立和維護額外的生成樹就是MST進程(MSTIS)。IST的進程號為0,MSTIS的進程號為1、2、3等。即使MST區是互連的,任何MSTI也都是本地于MST區並且獨立于另一個區的MSTI,MST進程和IST在MST區的邊界組合在一起構成了CST。MSTI的生成樹資訊包含在MSTP的記錄(M-record)中,M-record總是封裝在MST的BPDUS中。由MSTP計算的原始生成樹叫做M樹(M-tree),M樹只在MST區活躍,M樹和IST在MST區的邊界合併而形成CST


 

Cisco Reference

MST Region

As previously mentioned, the main enhancement introduced by MST is that several VLANs can be mapped to a single spanning tree instance. This raises the problem of how to determine which VLAN is to be associated with which instance. More precisely, how to tag BPDUs so that the receiving devices can identify the instances and the VLANs to which each device applies.

The issue is irrelevant in the case of the 802.1q standard, where all instances are mapped to a unique instance. In the PVST+ implementation, the association is as follows:

  • Different VLANs carry the BPDUs for their respective instance (one BPDU per VLAN).

The Cisco MISTP sent a BPDU for each instance, including a list of VLANs that the BPDU was responsible for, in order to solve this problem. If by error, two switches were misconfigured and had a different range of VLANs associated to the same instance, it was difficult for the protocol to recover properly from this situation.

The IEEE 802.1s committee adopted a much easier and simpler approach that introduced MST regions. Think of a region as the equivalent of Border Gateway Protocol (BGP) Autonomous Systems, which is a group of switches placed under a common administration.

MST Configuration and MST Region

Each switch running MST in the network has a single MST configuration that consists of these three attributes:

  1. An alphanumeric configuration name (32 bytes)
  2. A configuration revision number (two bytes)
  3. A 4096-element table that associates each of the potential 4096 VLANs supported on the chassis to a given instance

In order to be part of a common MST region, a group of switches must share the same configuration attributes. It is up to the network administrator to properly propagate the configuration throughout the region. Currently, this step is only possible by the means of the command line interface (CLI) or through Simple Network Management Protocol (SNMP). Other methods can be envisioned, as the IEEE specification does not explicitly mention how to accomplish that step.

Note: If for any reason two switches differ on one or more configuration attribute, the switches are part of different regions. For more information refer to the Region Boundary section of this document.

Region Boundary

In order to ensure consistent VLAN-to-instance mapping, it is necessary for the protocol to be able to exactly identify the boundaries of the regions. For that purpose, the characteristics of the region are included in the BPDUs. The exact VLANs-to-instance mapping is not propagated in the BPDU, because the switches only need to know whether they are in the same region as a neighbor. Therefore, only a digest of the VLANs-to-instance mapping table is sent, along with the revision number and the name. Once a switch receives a BPDU, the switch extracts the digest (a numerical value derived from the VLAN-to-instance mapping table through a mathematical function) and compares this digest with its own computed digest. If the digests differ, the port on which the BPDU was received is at the boundary of a region.

In generic terms, a port is at the boundary of a region if the designated bridge on its segment is in a different region or if it receives legacy 802.1d BPDUs. In this diagram, the port on B1 is at the boundary of region A, whereas the ports on B2 and B3 are internal to region B:


MST Instances

According to the IEEE 802.1s specification, an MST bridge must be able to handle at least these two instances:

  • One Internal Spanning Tree (IST)
  • One or more Multiple Spanning Tree Instance(s) (MSTIs)

The terminology continues to evolve, as 802.1s is actually in a pre-standard phase. It is likely these names will change in the final release of 802.1s. The Cisco implementation supports 16 instances: one IST (instance 0) and 15 MSTIs.

IST Instances

In order to clearly understand the role of the IST instance, remember that MST originates from the IEEE. Therefore, MST must be able to interact with 802.1d-based networks, because 802.1d is another IEEE standard. For 802.1d, a bridged network only implements a single spanning tree (CST). The IST instance is simply an RSTP instance that extends the CST inside the MST region.

The IST instance receives and sends BPDUs to the CST. The IST can represent the entire MST region as a CST virtual bridge to the outside world.

These are two functionally equivalent diagrams. Notice the location of the different blocked ports. In a typically bridged network, you expect to see a blocked port between Switches M and B. Instead of blocking on D, you expect to have the second loop broken by a blocked port somewhere in the middle of the MST region. However, due to the IST, the entire region appears as one virtual bridge that runs a single spanning tree (CST). This makes it possible to understand that the virtual bridge blocks an alternate port on B. Also, that virtual bridge is on the C to D segment and leads Switch D to block its port.


The exact mechanism that makes the region appear as one virtual CST bridge is beyond the scope of this document, but is amply described in the IEEE 802.1s specification. However, if you keep this virtual bridge property of the MST region in mind, the interaction with the outside world is much easier to understand.

MSTIs

The MSTIs are simple RSTP instances that only exist inside a region. These instances run the RSTP automatically by default, without any extra configuration work. Unlike the IST, MSTIs never interact with the outside of the region. Remember that MST only runs one spanning tree outside of the region, so except for the IST instance, regular instances inside of the region have no outside counterpart. Additionally, MSTIs do not send BPDUs outside a region, only the IST does.

MSTIs do not send independent individual BPDUs. Inside the MST region, bridges exchange MST BPDUs that can be seen as normal RSTP BPDUs for the IST while containing additional information for each MSTI. This diagram shows a BPDU exchange between Switches A and B inside an MST region. Each switch only sends one BPDU, but each includes one MRecord per MSTI present on the ports.


Note: In this diagram, notice that the first information field carried by an MST BPDU contains data about the IST. This implies that the IST (instance 0) is always present everywhere inside an MST region. However, the network administrator does not have to map VLANs onto instance 0, and therefore this is not a source of concern.

Unlike regular converged spanning tree topology, both ends of a link can send and receive BPDUs simultaneously. This is because, as shown in this diagram, each bridge can be designated for one or more instances and needs to transmit BPDUs. As soon as a single MST instance is designated on a port, a BPDU that contains the information for all instances (IST+ MSTIs) is to be sent. The diagram shown here demonstrates MST BDPUs sent inside and outside of an MST region:


The MRecord contains enough information (mostly root bridge and sender bridge priority parameters) for the corresponding instance to calculate its final topology. The MRecord does not need any timer-related parameters such as hello time, forward delay, and max age that are typically found in a regular IEEE 802.1d or 802.1q CST BPDU. The only instance in the MST region to use these parameters is the IST; the hello time determines how frequently BPDUs are sent, and the forward delay parameter is mainly used when rapid transition is not possible (remember that rapid transitions do not occur on shared links). As MSTIs depend on the IST to transmit their information, MSTIs do not need those timers.

Common Misconfigurations(如需使用MST時請注意下列常犯錯誤)

The independence between instance and VLAN is a new concept that implies you must carefully plan your configuration. The IST Instance is Active on All Ports, Whether Trunk or Access section illustrates some common pitfalls and how to avoid them.

IST Instance is Active on All Ports, Whether Trunk or Access

This diagram shows Switches A and B connected with access ports each located in different VLANs. VLAN 10 and VLAN 20 are mapped to different instances. VLAN 10 is mapped to instance 0, while VLAN 20 is mapped to instance 1.


This configuration results in pcA ‘s inability to send frames to pcB. The show command reveals that Switch B is blocking the link to Switch A in VLAN 10, as shown in the this diagram:


How is that possible in such a simple topology, with no apparent loop?

This issue is explained by the fact that MST information is conveyed with only one BPDU (IST BPDU), regardless of the number of internal instances. Individual instances do not send individual BPDUs. When Switch A and Switch B exchange STP information for VLAN 20, the switches send an IST BPDU with an MRecord for instance 1 because that is where VLAN 20 is mapped. However, because it is an IST BPDU, this BPDU also contains information for instance 0. This means that the IST instance is active on all ports inside an MST region, whether these ports carry VLANs mapped to the IST instance or not.

This diagram shows the logical topology of the IST instance:


Switch B receives two BPDUs for instance 0 from Switch A (one on each port). It is clear that Switch B has to block one of its ports in order to avoid a loop.

The preferred solution is to use one instance for VLAN 10 and another instance for VLAN 20 to avoid mapping VLANs to the IST instance.

An alternative is to carry those VLANs mapped to the IST on all links (allow VLAN 10 on both ports, as in this

diagram).

Two VLANs Mapped to the Same Instance Block the Same Ports

Remember that VLAN no longer means spanning tree instance. The topology is determined by the instance, regardless of the VLANs mapped to it. This diagram shows a problem that is a variant of the one discussed in the IST Instance is Active on All Ports, Whether Trunk or Access section:


Suppose that VLANs 10 and 20 are both mapped to the same instance (instance 1). The network administrator wants to manually prune VLAN 10 on one Uplink and VLAN 20 on the other in order to restrict traffic on the Uplink trunks from Switch A to distribution Switches D1 and D2 (an attempt to achieve a topology as described in the previous diagram). Shortly after this is completed, the network administrator notices that users in VLAN 20 have lost connectivity to the network.

This is a typical misconfiguration problem. VLANs 10 and 20 are both mapped to instance 1, which means there is only one logical topology for both VLANs. Load-sharing cannot be achieved, as shown here:


Because of the manual pruning, VLAN 20 is only allowed on the blocked port, which explains the loss of connectivity. In order to achieve load balancing, the network administrator must map VLAN 10 and 20 to two different instances.

A simple rule to follow to steer clear of this problem is to never manually prune VLANs off a trunk. If you decide to remove some VLANs off a trunk, remove all the VLANs mapped to a given instance together. Never remove an individual VLAN from a trunk and not remove all the VLANs that are mapped to the same instance.

Interaction Between the MST Region and the Outside World

With a migration to an MST network, the administrator is likely to have to deal with interoperability issues between MST and legacy protocols. MST seamlessly interoperates with standard 802.1q CST networks; however, only a handful of networks are based on the 802.1q standard because of its single spanning tree restriction. Cisco released PVST+ at the same time as support for 802.1q was announced. Cisco also provides an efficient yet simple compatibility mechanism between MST and PVST+. This mechanism is explained later in this document.

The first property of an MST region is that at the boundary ports no MSTI BPDUs are sent out, only IST BPDUs are. Internal instances (MSTIs) always automatically follow the IST topology at boundary ports, as shown in this diagram:


In this diagram, assume VLANs 10 through 50 are mapped to the green instance, which is an internal instance (MSTI) only. The red links represent the IST, and therefore also represent the CST. VLANs 10 through 50 are allowed everywhere in the topology. BPDUs for the green instance are not sent out of the MST region. This does not mean that there is a loop in VLANs 10 through 50. MSTIs follow the IST at the boundary ports, and the boundary port on Switch B also blocks traffic for the green instance.

Switches that run MST are able to automatically detect PVST+ neighbors at boundaries. These switches are able to detect that multiple BPDUs are received on different VLANs of a trunk port for the instance.

This diagram shows an interoperability issue. An MST region only interacts with one spanning tree (the CST) outside of the region. However, PVST+ bridges run one Spanning Tree Algorithm (STA) per VLAN, and as a result, send one BPDU on each VLAN every two seconds. The boundary MST bridge does not expect to receive that many BPDUs. The MST bridge either expects to receive one or to send one, depending on whether the bridge is the root of the CST or not.


Cisco developed a mechanism to address the problem shown in this diagram. A possibility could have consisted of tunneling the extra BPDUs sent by the PVST+ bridges across the MST region. However, this solution has proven to be too complex and potentially dangerous when first implemented in the MISTP. A simpler approach was created. The MST region replicates the IST BPDU on all the VLANs to simulate a PVST+ neighbor. This solution implies a few constraints that are discussed in this document.

Recommended Configuration

As the MST region now replicates the IST BPDUs on every VLAN at the boundary, each PVST+ instance hears a BPDU from the IST root (this implies the root is located inside the MST region). It is recommended that the IST root have a higher priority than any other bridge in the network so that the IST root becomes the root for all of the different PVST+ instances, as shown in this diagram:


In this diagram, Switch C is a PVST+ redundantly connected to an MST region. The IST root is the root for all PVST+ instances that exist on Switch C. As a result, Switch C blocks one of its Uplinks in order to prevent loops. In this particular case, interaction between PVST+ and the MST region is optimal because:

  • Switch C’s Uplink ports’ costs can be tuned to achieve load balancing of the different VLANs across the Uplinks’ ports (because Switch C runs one spanning tree per VLAN, this switch is able to chose which Uplink port blocks on a per-VLAN basis).
  • UplinkFast can be used on Switch C to achieve fast convergence in case of an Uplink failure.

Alternate Configuration (Not Recommended)

Another possibility is to have the IST region be the root for absolutely no PVST+ instance. This means that all PVST+ instances have a better root than the IST instance, as shown in this diagram:


This case corresponds to a PVST+ core and an MST access or distribution layer, a rather infrequent scenario. If you establish the root bridge outside the region, there are these drawbacks as compared to the previously recommended configuration:

  • An MST region only runs one spanning tree instance that interacts with the outside world. This basically means that a boundary port can only be blocking or forwarding for all VLANs. In other terms, there is no load balancing possible between the region’s two Uplinks that lead to Switch C. The Uplink on Switch B for the instance will be blocking for all VLANs while Switch A will be forwarding for all VLANs.
  • This configuration still allows for fast convergence inside the region. If the Uplink on Switch A fails, a fast switchover to an Uplink on a different switch needs to be achieved. While the way the IST behaves inside the region in order to have the whole MST region resemble a CST bridge was not discussed in detail, you can imagine that a switchover across a region is never as efficient as a switchover on a single bridge.

Invalid Configuration

While the PVST+ emulation mechanism provides easy and seamless interoperability between MST and PVST+, this mechanism implies that any configuration other than the two previously mentioned is invalid. These are the basic rules that must be followed to get a successful MST and PVST+ interaction:

  1. If the MST bridge is the root, this bridge must be the root for all VLANs.
  2. If the PVST+ bridge is the root, this bridge must be the root for all VLANs (including the CST, which always runs on VLAN 1, regardless of the native VLAN, when the CST runs PVST+).
  3. The simulation fails and produces an error message if the MST bridge is the root for the CST, while the PVST+ bridge is the root for one or more other VLANs. A failed simulation puts the boundary port in root inconsistent mode.


In this diagram, Bridge A in the MST region is the root for all three PVST+ instances except one (the red VLAN). Bridge C is the root of the red VLAN. Suppose that the loop created on the red VLAN, where Bridge C is the root, becomes blocked by Bridge B. This means that Bridge B is designated for all VLANs except the red one. An MST region is not able to do that. A boundary port can only be blocking or forwarding for all VLANs because the MST region is only running one spanning tree with the outside world. Thus, when Bridge B detects a better BPDU on its boundary port, the bridge invokes the BPDU guard to block this port. The port is placed in the root inconsistent mode. The exact same mechanism also leads Bridge A to block its boundary port. Connectivity is lost; however, a loop-free topology is preserved even in the presence of such a misconfiguration.

Note: As soon as a boundary port produces a root inconsistent error, investigate whether a PVST+ bridge has attempted to become the root for some VLANs.

Migration Strategy

The first step in the migration to 802.1s/w is to properly identify point-to-point and edge ports. Ensure all switch-to-switch links, on which a rapid transition is desired, are full-duplex. Edge ports are defined through the PortFast feature. Carefully decide how many instances are needed in the switched network, and keep in mind that an instance translates to a logical topology. Decide what VLANs to map onto those instances, and carefully select a root and a back-up root for each instance. Choose a configuration name and a revision number that will be common to all switches in the network. Cisco recommends that you place as many switches as possible into a single region; it is not advantageous to segment a network into separate regions. Avoid mapping any VLANs onto instance 0. Migrate the core first. Change the STP type to MST, and work your way down to the access switches. MST can interact with legacy bridges running PVST+ on a per-port basis, so it is not a problem to mix both types of bridges if interactions are clearly understood. Always try to keep the root of the CST and IST inside the region. If you interact with a PVST+ bridge through a trunk, ensure the MST bridge is the root for all VLANs allowed on that trunk.

For sample configurations, refer to:

802.1D vs 802.1W

New Port States and Port Roles

The 802.1D is defined in these four different port states:

  • Listening (交換 bpdu決定 界面將扮演的角色)
  • Learning (學習接收的訊框來源 MAC-ADDRESS 形成 CAM 記錄表)
  • Blocking (正常運作中 封閉資料訊框傳送功能的界面)
  • Forwarding (正常運作中可傳送資料訊框的狀態)

See the table in the Port States section of this document for more information.

The state of the port is mixed, whether it blocks or forwards traffic, and the role it plays in the active topology (root port, designated port, and so on). For example, from an operational point of view, there is no difference between a port in the blocking state and a port in the listening state. Both discard frames and do not learn MAC addresses. The real difference lies in the role the spanning tree assigns to the port. It can safely be assumed that a listening port is either designated or root and is on its way to the forwarding state. Unfortunately, once in the forwarding state, there is no way to infer from the port state whether the port is root or designated. This contributes to demonstrate the failure of this state-based terminology. RSTP decouples the role and the state of a port to address this issue.

Port States

There are only three port states left in RSTP that correspond to the three possible operational states. The 802.1D disabled, blocking, and listening states are merged into a unique 802.1w discarding state.

STP (802.1D) Port State

RSTP (802.1w) Port State

Is Port Included in Active Topology?

Is Port Learning MAC Addresses?

Disabled

Discarding

No

No

Blocking

Discarding

No

No

Listening

Discarding

Yes

No

Learning

Learning

Yes

Yes

Forwarding

Forwarding

Yes

Yes

Port Roles

The role is now a variable assigned to a given port. The root port and designated port roles remain, while the blocking port role is split into the backup and alternate port roles. The Spanning Tree Algorithm (STA) determines the role of a port based on Bridge Protocol Data Units (BPDUs). In order to simplify matters, the thing to remember about a BPDU is there is always a method to compare any two of them and decide whether one is more useful than the other. This is based on the value stored in the BPDU and occasionally on the port on which they are received. This considered, the information in this section explains practical approaches to port roles.

Root Port Roles

  • The port that receives the best BPDU on a bridge is the root port. This is the port that is the closest to the root bridge in terms of path cost. The STA elects a single root bridge in the whole bridged network (per-VLAN). The root bridge sends BPDUs that are more useful than the ones any other bridge sends. The root bridge is the only bridge in the network that does not have a root port. All other bridges receive BPDUs on at least one port.


Designated Port Role

  • A port is designated if it can send the best BPDU on the segment to which it is connected. 802.1D bridges link together different segments, such as Ethernet segments, to create a bridged domain. On a given segment, there can only be one path toward the root bridge. If there are two, there is a bridging loop in the network. All bridges connected to a given segment listen to the BPDUs of each and agree on the bridge that sends the best BPDU as the designated bridge for the segment. The port on that bridge that corresponds is the designated port for that segment.


Alternate and Backup Port Roles

  • These two port roles correspond to the blocking state of 802.1D. A blocked port is defined as not being the designated or root port. A blocked port receives a more useful BPDU than the one it sends out on its segment. Remember that a port absolutely needs to receive BPDUs in order to stay blocked. RSTP introduces these two roles for this purpose.
  • An alternate port receives more useful BPDUs from another bridge and is a port blocked. This is shown in this diagram:


  • A backup port receives more useful BPDUs from the same bridge it is on and is a port blocked. This is shown in this diagram:


This distinction is already made internally within 802.1D. This is essentially how Cisco UplinkFast functions. The rationale is that an alternate port provides an alternate path to the root bridge and therefore can replace the root port if it fails. Of course, a backup port provides redundant connectivity to the same segment and cannot guarantee an alternate connectivity to the root bridge. Therefore, it is excluded from the uplink group.

As a result, RSTP calculates the final topology for the spanning tree that uses the same criteria as 802.1D. There is absolutely no change in the way the different bridge and port priorities are used. The name blocking is used for the discarding state in Cisco implementation. CatOS releases 7.1 and later still display the listening and learning states. This gives even more information about a port than the IEEE standard requires. However, the new feature is now there is a difference between the role the protocol determines for a port and its current state. For example, it is now perfectly valid for a port to be designated and blocking at the same time. While this typically occurs for very short periods of time, it simply means that this port is in a transitory state towards the designated forwarding state.

New BPDU Format

Few changes have been introduced by RSTP to the BPDU format. Only two flags, Topology Change (TC) and TC Acknowledgment (TCA), are defined in 802.1D. However, RSTP now uses all six bits of the flag byte that remain in order to perform:

  • Encode the role and state of the port that originates the BPDU
  • Handle the proposal/agreement mechanism


Another important change is that the RSTP BPDU is now of type 2, version 2. The implication is that legacy bridges must drop this new BPDU. This property makes it easy for a 802.1w bridge to detect legacy bridges connected to it.

New BPDU Handling

BPDU are Sent Every Hello-Time

BPDU are sent every hello-time, and not simply relayed anymore. With 802.1D, a non-root bridge only generates BPDUs when it receives one on the root port. In fact, a bridge relays BPDUs more than it actually generates them. This is not the case with 802.1w. A bridge now sends a BPDU with its current information every <hello-time> seconds (2 by default), even if it does not receive any from the root bridge.

Faster Aging of Information

On a given port, if hellos are not received three consecutive times, protocol information can be immediately aged out (or if max_age expires). Because of the previously mentioned protocol modification, BPDUs are now used as a keep-alive mechanism between bridges. A bridge considers that it loses connectivity to its direct neighbor root or designated bridge if it misses three BPDUs in a row. This fast aging of the information allows quick failure detection. If a bridge fails to receive BPDUs from a neighbor, it is certain that the connection to that neighbor is lost. This is opposed to 802.1D where the problem might have been anywhere on the path to the root.

Note: Failures are detected even much faster in case of physical link failures.

Accepts Inferior BPDUs

This concept is what makes up the core of the BackboneFast engine. The IEEE 802.1w committee decided to incorporate a similar mechanism into RSTP. When a bridge receives inferior information from its designated or root bridge, it immediately accepts it and replaces the one previously stored.


Because Bridge C still knows the root is alive and well, it immediately sends a BPDU to Bridge B that contains information about the root bridge. As a result, Bridge B does not send its own BPDUs and accepts the port that leads to Bridge C as the new root port.

Rapid Transition to Forwarding State

Rapid transition is the most important feature introduced by 802.1w. The legacy STA passively waited for the network to converge before it turned a port into the forwarding state. The achievement of faster convergence was a matter of tuning the conservative default parameters (forward delay and max_age timers) and often put the stability of the network at stake. The new rapid STP is able to actively confirm that a port can safely transition to the forwarding state without having to rely on any timer configuration. There is now a real feedback mechanism that takes place between RSTP-compliant bridges. In order to achieve fast convergence on a port, the protocol relies upon two new variables: edge ports and link type.

Edge Ports

The edge port concept is already well known to Cisco spanning tree users, as it basically corresponds to the PortFast feature. All ports directly connected to end stations cannot create bridging loops in the network. Therefore, the edge port directly transitions to the forwarding state, and skips the listening and learning stages. Neither edge ports or PortFast enabled ports generate topology changes when the link toggles. Unlike PortFast, an edge port that receives a BPDU immediately loses edge port status and becomes a normal spanning tree port. At this point, there is a user-configured value and an operational value for the edge port state. The Cisco implementation maintains that the PortFast keyword be used for edge port configuration. This makes the transition to RSTP simpler.

Link Type

RSTP can only achieve rapid transition to the forwarding state on edge ports and on point-to-point links. The link type is automatically derived from the duplex mode of a port. A port that operates in full-duplex is assumed to be point-to-point, while a half-duplex port is considered as a shared port by default. This automatic link type setting can be overridden by explicit configuration. In switched networks today, most links operate in full-duplex mode and are treated as point-to-point links by RSTP. This makes them candidates for rapid transition to the forwarding state.

Convergence with 802.1D

This diagram illustrates how 802.1D deals with a new link that is added to a bridged network:


In this scenario, a link between the root bridge and Bridge A is added. Suppose there already is an indirect connection between Bridge A and the root bridge (via C – D in the diagram). The STA blocks a port and disables the bridging loop. First, as they come up, both ports on the link between the root and Bridge A are put in the listening state. Bridge A is now able to hear the root directly. It immediately propagates its BPDUs on the designated ports, toward the leaves of the tree. As soon as Bridges B and C receive this new superior information from Bridge A, they immediately relay the information towards the leaves. In a few seconds, Bridge D receives a BPDU from the root and instantly blocks port P1.


Spanning tree is very efficient in how it calculates the new topology of the network. The only problem now is that twice the forward delay must elapse before the link between the root and Bridge A eventually ends up in the forwarding state. This means 30 seconds of disruption of traffic (the entire A, B, and C part of the network is isolated) because the 8021.D algorithm lacks a feedback mechanism to clearly advertise that the network converges in a matter of seconds.

Convergence with 802.1w

Now, you can see how RSTP deals with a similar situation. Remember that the final topology is exactly the same as the one calculated by 802.1D (that is, one blocked port at the same place as before). Only the steps used to reach this topology have changed.

Both ports on the link between A and the root are put in designated blocking as soon as they come up. Thus far, everything behaves as in a pure 802.1D environment. However, at this stage, a negotiation takes place between Switch A and the root. As soon as A receives the BPDU of the root, it blocks the non-edge designated ports. This operation is called sync. Once this is done, Bridge A explicitly authorizes the root bridge to put its port in the forwarding state. This diagram illustrates the result of this process on the network. The link between Switch A and the root bridge is blocked, and both bridges exchange BPDUs.


Once Switch A blocks its non-edge designated ports, the link between Switch A and the root is put in the forwarding state and you reach the situation:


There still cannot be a loop. Instead of blocking above Switch A, the network now blocks below Switch A. However, the potential bridging loop is cut at a different location. This cut travels down the tree along with the new BPDUs originated by the root through Switch A. At this stage, the newly blocked ports on Switch A also negotiate a quick transition to the forwarding state with their neighbor ports on Switch B and Switch C that both initiate a sync operation. Other than the root port towards A, Switch B only has edge designated ports. Therefore, it has no port to block in order to authorize Switch A to go to the forwarding state. Similarly, Switch C only has to block its designated port to D. The state shown in this diagram is now reached:


Remember that the final topology is exactly the same as the 802.1D example, which means that port P1 on D ends up blocking. This means that the final network topology is reached, just in the time necessary for the new BPDUs to travel down the tree. No timer is involved in this quick convergence. The only new mechanism introduced by RSTP is the acknowledgment that a switch can send on its new root port in order to authorize immediate transition to the forwarding state, and bypasses the twice-the-forward-delay long listening and learning stages. The administrator only needs to remember these to benefit from fast convergence:

  • This negotiation between bridges is only possible when bridges are connected by point-to-point links (that is, full-duplex links unless explicit port configuration).
  • Edge ports play an even more important role now that PortFast is enabled on ports in 802.1D. For instance, if the network administrator fails to properly configure the edge ports on B, their connectivity is impacted by the link between A and the root that comes up.

Proposal/Agreement Sequence

When a port is selected by the STA to become a designated port, 802.1D still waits twice <forward delay> seconds (2×15 by default) before it transitions it to the forwarding state. In RSTP, this condition corresponds to a port with a designated role but a blocking state. These diagrams illustrate how fast transition is achieved step-by-step. Suppose a new link is created between the root and Switch A. Both ports on this link are put in a designated blocking state until they receive a BPDU from their counterpart.


When a designated port is in a discarding or learning state (and only in this case), it sets the proposal bit on the BPDUs it sends out. This is what occurs for port p0 of the root bridge, as shown in step 1 of the preceding diagram. Because Switch A receives superior information, it immediately knows that p1 is the new root port. Switch A then starts a sync to verify that all of its ports are in-sync with this new information. A port is in sync if it meets either of these criteria:

  • The port is in the blocking state, which means discarding in a stable topology.
  • The port is an edge port.

In order to illustrate the effect of the sync mechanism on different kind of ports, suppose there exists an alternate port p2, a designated forwarding port p3, and an edge port p4 on Switch A. Notice that p2 and p4 already meet one of the criteria. In order to be in sync (see step 2 of the preceding diagram), Switch A just needs to block port p3, and assign it the discarding state. Now that all of its ports are in sync, Switch A can unblock its newly selected root port p1 and send an agreement message to reply to the root. (see step 3). This message is a copy of the proposal BPDU, with the agreement bit set instead of the proposal bit. This ensures that port p0 knows exactly to which proposal the agreement it receives corresponds.


Once p0 receives that agreement, it can immediately transition to the forwarding state. This is step 4 of the preceding figure. Notice that port p3 is left in a designated discarding state after the sync. In step 4, that port is in the exact same situation as port p0 is in step 1. It then starts to propose to its neighbor, and attempts to quickly transition to the forwarding state.


UplinkFast

Another form of immediate transition to the forwarding state included in RSTP is similar to the Cisco UplinkFast proprietary spanning tree extension. Basically, when a bridge loses its root port, it is able to put its best alternate port directly into the forwarding mode (the appearance of a new root port is also handled by RSTP). The selection of an alternate port as the new root port generates a topology change. The 802.1w topology change mechanism clears the appropriate entries in the Content Addressable Memory (CAM) tables of the upstream bridge. This removes the need for the dummy multicast generation process of UplinkFast.

UplinkFast does not need to be configured further because the mechanism is included natively and enabled in RSTP automatically.

New Topology Change Mechanisms

When an 802.1D bridge detects a topology change, it uses a reliable mechanism to first notify the root bridge. This is shown in this diagram:


Once the root bridge is aware of a change in the topology of the network, it sets the TC flag on the BPDUs it sends out, which are then relayed to all the bridges in the network. When a bridge receives a BPDU with the TC flag bit set, it reduces its bridging-table aging time to forward delay seconds. This ensures a relatively quick flush of stale information. Refer to Understanding Spanning-Tree Protocol Topology Changes for more information on this process. This topology change mechanism is deeply remodeled in RSTP. Both the detection of a topology change and its propagation through the network evolve.