GLBP

GLBP

• Gateway load balancing Protocol  Cisco Propetiary
• Extends HRSP functionality to natively support load balancing
• We can load balance in VRRP or HRSP by configuring multiple groups on interfaces
• But GLBP provides native inbuilt load balancing forUp to 4 devices
• There is 2 election first election is for AVG (Active Virtual Gateway) this is based on priority and highest ip as tie breaker
• The AVG will then look at all possible forwarders if there is more than 4 it will elect forwarders and standby devices.
• This election is based on weight. The weight will also decipher traffic share of load balancing given to each gateway. It is not exact but provides some level of weight
• When a client arp for the gateway address the AVG will reply with the mac of one of the forwarder it will go throught them in weighted round robin way
• As client keep arp cache and will not arp every time for the gateway address so the load balancing is not exact
• By default, GLBP routers use the local multicast address 224.0.0.102 to send hello packets to their peers every 3 seconds over UDP 3222 (source and destination)
• We can manipulate to weight in conjuction with the likes of ip sla and enhanced object tracking to say if a particualr happens the weight will be decremented.
• We configure upper and lower limit if we go below the lower limit we lose our avf status the upper limit is the weight we must be at the regain our avf status
• default priority is 100

Commands

int fa0/0
glbp 10 ip 10.10.10.1
glbp 10 priority 110
glbp 10 weighting 110 lower 85 upper 105
glbp 10 track 20 decrement 30

ip sla 18
icmp echo 10.9.9.9
ip sla schedule 18 start now life forever

track 20 rtr 18 state

so in the abover we track the reachability from this layer 3 switch to 10.9.9.9 if it is not reachable we decrement our weight by 30 this would have us at weight 80 below the lower limit so we would lose our avf status

LAB
----

r6
---
r6(config-subif)#int fa0/0.146
r6(config-subif)#glbp 10 ip 155.0.146.254
r6(config-subif)#
*Feb 25 13:48:26.962: GLBP: joining IPv4 multicast on Fa0/0.146
*Feb 25 13:48:26.962: GLBP: joining IPv6 multicast on Fa0/0.146
*Feb 25 13:48:26.962: GLBP: Fa0/0.146 API 155.0.146.254 is not a GLBP address in table 0
*Feb 25 13:48:26.962: GLBP: Fa0/0.146 10 Disabled: a/GLBP IP address configured
*Feb 25 13:48:26.962: GLBP: Fa0/0.146 10 Disabled -> Init
r6(config-subif)#
*Feb 25 13:48:36.966: GLBP: Fa0/0.146 Interface up
*Feb 25 13:48:36.966: GLBP: Fa0/0.146 10 Init: d/GLBP enabled
*Feb 25 13:48:36.966: GLBP: Fa0/0.146 10 Init -> Listen
*Feb 25 13:48:39.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Listen  pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:39.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:39.966:     UDP src=3222, dst=3222
*Feb 25 13:48:42.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Listen  pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:42.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:42.966:     UDP src=3222, dst=3222
*Feb 25 13:48:45.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Listen  pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:45.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:45.966:     UDP src=3222, dst=3222
*Feb 25 13:48:46.966: GLBP: Fa0/0.146 10 Listen: g/Active timer expired (unknown)
*Feb 25 13:48:46.966: GLBP: Fa0/0.146 10 Listen -> Speak
*Feb 25 13:48:46.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Speak   pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:46.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:46.966:     UDP src=3222, dst=3222
*Feb 25 13:48:49.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Speak   pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:49.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:49.966:     UDP src=3222, dst=3222
*Feb 25 13:48:52.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Speak   pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:52.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:52.966:     UDP src=3222, dst=3222
*Feb 25 13:48:55.874: IP: s=155.0.67.1 (FastEthernet0/0.67), d=224.0.0.1, len 28, rcvd 0, proto=2
*Feb 25 13:48:55.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Speak   pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:55.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:55.966:     UDP src=3222, dst=3222
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Speak: f/Standby timer expired (unknown)
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Standby router is local
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Speak -> Standby
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 Grp 10 Hello  out VG Standby pri 100 vIP 155.0.146.254 hello 3000, hold 10000
*Feb 25 13:48:56.966: IP: s=155.0.146.6 (local), d=224.0.0.102 (FastEthernet0/0.146), len 68, sending broad/multicast
*Feb 25 13:48:56.966:     UDP src=3222, dst=3222
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Standby: g/Active timer expired (unknown)
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Active router IP is local
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Standby router is unknown, was local
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10 Standby -> Active
*Feb 25 13:48:56.966: %GLBP-6-STATECHANGE: FastEthernet0/0.146 Grp 10 state Standby -> Active
*Feb 25 13:48:56.966: GLBP: Fa0/0.146 10.1 Disabled: a/Forwarder MAC address acquired

we can see we are multicasting out 224.0.0.102 over protocol udp 3222
we go through VG (virtual gateway) listen and speak this is where would be doing the election if other gateways where online none are so we become active as the AVG


r6#sh glbp
FastEthernet0/0.146 - Group 10
  State is Active
    2 state changes, last state change 00:02:54
  Virtual IP address is 155.0.146.254
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.308 secs
  Redirect time 600 sec, forwarder time-out 14400 sec
  Preemption disabled
  Active is local
  Standby is unknown
  Priority 100 (default)
  Weighting 100 (default 100), thresholds: lower 1, upper 100
  Load balancing: round-robin
  Group members:
    0013.80e4.901a (155.0.146.6) local
  There is 1 forwarder (1 active)
  Forwarder 1
    State is Active
      1 state change, last state change 00:02:44
    MAC address is 0007.b400.0a01 (default)
    Owner ID is 0013.80e4.901a
    Redirection enabled
    Preemption enabled, min delay 30 sec
    Active is local, weighting 100
r6#

There is 2 parts to this output mainly the first part is referencing the active gateway and the 2nd part is refernecing the forwarders


r4
---
r4(config)#int fa0/1
r4(config-if)#glbp 10 ip 155.0.146.254


r4#sh glbp
FastEthernet0/1 - Group 10
  State is Standby
    1 state change, last state change 00:00:01
  Virtual IP address is 155.0.146.254
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.572 secs
  Redirect time 600 sec, forwarder time-out 14400 sec
  Preemption disabled
  Active is 155.0.146.6, priority 100 (expires in 9.928 sec)
  Standby is local
  Priority 100 (default)
  Weighting 100 (default 100), thresholds: lower 1, upper 100
  Load balancing: round-robin
  Group members:
    0012.d993.728d (155.0.146.4) local
    0013.80e4.901a (155.0.146.6)
  There are 2 forwarders (1 active)
  Forwarder 1
    State is Listen
    MAC address is 0007.b400.0a01 (learnt)
    Owner ID is 0013.80e4.901a
    Time to live: 14399.928 sec (maximum 14400 sec)
    Preemption enabled, min delay 30 sec
    Active is 155.0.146.6 (primary), weighting 100 (expires in 9.452 sec)
  Forwarder 2
    State is Active
      1 state change, last state change 00:00:11
    MAC address is 0007.b400.0a02 (default)
    Owner ID is 0012.d993.728d
    Preemption enabled, min delay 30 sec
    Active is local, weighting 100
r4#
so we are in standby for the AVG as r6 is the AVG
there is 2 forwarders on the link

r6
---
r6(config-subif)#int fa0/0.146
r6(config-subif)#glbp 10 priority 90

the priority is in relation to active gateway not forwarding
preemption is disabled by default

r4
----
r4(config)#int fa0/1
r4(config-if)#glbp 10 preempt
r4(config-if)#
*Feb 25 13:45:44.866: %GLBP-6-STATECHANGE: FastEthernet0/1 Grp 10 state Standby -> Active

now i am the active gateway so i am responding to the arp request

if we look at this command on r4
r4(config)#int fa0/1
r4(config-if)#glbp 10 weighting 110 lower 85 upper 105

so the lower limit if my weighting goes below 85 i will no longer forward for the segement
but if my weighting comes back up to 105 i will be allowed forward for the segment
r4(config-if)#glbp 1 weighting track 1

We can get into complex ip sla so say if one ip is unreachable decrement 20 if another is down decrement by 10 so like we can be very specfic on what conditions we forwarder undert by messing around with the weights

we also tell r4 we want to load balance based on weighting
r4(config-if)#glbp 10 load-balancing weighted

VRRP

VRRP

• IETF alternative to HRSP
• Use terms master/backup as opposed to primary and standby
• Concepts are nearly identical
• Vrrp has preemt on by default
• Also lower default timers 1 hello 3 dead
• It uses a virtual mac of 0000.5E00.01xx where xx is the group
• uses vrrp interface command instead of standby
• It has it own dedicated protocol number so not using udp the vrrp protocol number is 112
• Also it has it own dedicated multicast group 224.0.0.18
• it can only object track it does not have the track interface option compared to hrsp but in general track object like ip sla is the better choice as track interface is depending on line protocol
• it supports md5 authentication implented the same with key chain and key string same as hrsp
• it also support plain text authentication

Commands

int fa0/1
vrrp 10 ip 155.0.0.10
vrrp 10 authentication md5 key-chain cisco
or
vrrp 10 authentication key-string 'cisco'
vrrp prempt delay 10 - wait 10 seconds before preempting


LAB

As this almost identical to hrsp i will just do a quick lab and then do lab on authentication
this authentication would work on both hrsp or vrrp of glbp

r6(config)#int fa0/0.146
r6(config-subif)#vrrp 10 ip 155.0.146.254
r6(config-subif)#
*Feb 25 12:54:13.795: %VRRP-6-STATECHANGE: Fa0/0.146 Grp 10 state Create -> Disable
*Feb 25 12:54:13.795: VRRP: Grp 10 Event - primary IP configured
*Feb 25 12:54:13.795: %VRRP-6-STATECHANGE: Fa0/0.146 Grp 10 state Disable -> Init
*Feb 25 12:54:13.795: VRRP: vrrp_interface_state: Fa0/0.146 is Up
*Feb 25 12:54:13.795: VRRP: Grp 10 Event - Interface UP
*Feb 25 12:54:13.795: %VRRP-6-STATECHANGE: Fa0/0.146 Grp 10 state Init -> Backup
*Feb 25 12:54:17.407: VRRP: Grp 10 Event - Master down timer expired
*Feb 25 12:54:17.407: %VRRP-6-STATECHANGE: Fa0/0.146 Grp 10 state Backup -> Master
*Feb 25 12:54:17.407: VRRP: tbridge_smf_update failed
*Feb 25 12:54:17.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:17.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:18.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:18.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:19.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:19.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:20.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:20.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:21.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:21.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:22.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:22.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:23.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:23.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:24.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:24.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:25.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:25.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
*Feb 25 12:54:26.407: VRRP: Grp 10 sending Advertisement checksum 4CF4
*Feb 25 12:54:26.407: IP: s=155.0.146.6 (local), d=224.0.0.18 (FastEthernet0/0.146), len 40,
sending broad/multicast, proto=112
ok so we can see that it started in disabled went to init then backup then to master then it
started sending to the multicast group 224.0.0.18 and it has it own protocol 112 it is not
using udp 1985 like hrsp was


r4
---
r4#sh run int fa0/1
Building configuration...
Current configuration : 142 bytes
!
interface FastEthernet0/1
 ip address 155.0.146.4 255.255.255.0
 ip pim sparse-mode
 duplex auto
 speed auto
 vrrp 10 ip 155.0.146.254
end
r4#
one of the first things noticed is preempt is on by default

r4(config)#int fa0/1
r4(config-if)#vrrp 10 priority 105
r4(config-if)#
*Feb 25 12:44:25.875: %VRRP-6-STATECHANGE: Fa0/1 Grp 10 state Backup -> Master

so i do not need to configure preempt

next i will do a config of enable authentication on r4

on r4 i will enable authentication
r4(config)#int fa0/1
r4(config-if)#vrrp 10 authentication ?
  WORD  Plain text authentication string
  md5   Use MD5 authentication
  text  Plain text authentication
r4(config-if)#vrrp 10 authentication md5 ?
  key-chain   Set key chain
  key-string  Set key string
r4(config-if)#vrrp 10 authentication md5 key-string PASSWORD

r4#sh vrrp
FastEthernet0/1 - Group 10
  State is Master
  Virtual IP address is 155.0.146.254
  Virtual MAC address is 0000.5e00.010a
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 105
  Authentication MD5, key-string "PASSWORD"
  Master Router is 155.0.146.4 (local), priority is 105
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.589 sec
r4#

if we go to r6

r6#sh vrrp
FastEthernet0/0.146 - Group 10
  State is Master
  Virtual IP address is 155.0.146.254
  Virtual MAC address is 0000.5e00.010a
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 100
  Master Router is 155.0.146.6 (local), priority is 100
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.609 sec
r6#

effectively vrrp is not working both routers think they are masters

basically r4 is rejecting r6 vrrp packets
*Feb 25 12:53:11.875: VRRP: Grp 10 sending Advertisement checksum 2B15u
*Feb 25 12:53:12.487: VRRP: Grp 10 Advertisement from 155.0.146.6 has incorrect
                authentication type 0 expected 254
*Feb 25 12:53:12.875: VRRP: Grp 10 sending MD5 digest:

as of incorrect authentication so then r6 does not recieve reply from r4 so it believes it is
 the only vrrp router on the segment so it goes to the master state
on r6
------

r6(config)#int fa0/0.146
r6(config-subif)#vrrp 10 authentication md5 key-string PASSWORD

r6#sh vrrp
FastEthernet0/0.146 - Group 10
  State is Backup
  Virtual IP address is 155.0.146.254
  Virtual MAC address is 0000.5e00.010a
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 100
  Authentication MD5, key-string "PASSWORD"
  Master Router is 155.0.146.4, priority is 105
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.609 sec (expires in 3.349 sec)

has gone to backup and we are back in proper vrrp config

we could also specify a key chain if we wanted to do
r6(config)#do sh run | sec key chain
key chain VRRP-KEY
 key 1
  key-string PASSWORD
  accept-lifetime 00:00:00 Jan 1 1993 infinite
r6(config)#
r6(config)#int fa0/0.146
r6(config-subif)#vrrp 10 authentication md5 key-chain VRRP-KEY

another option for preempt in both hrsp glbp and vrrp
r6(config-subif)#int fa0/0.146
r6(config-subif)#vrrp 10 preempt delay minimum 10

we can configure that when a router finds out it has higher priority we can do a delay of a
few seconds so it does not preempt

HRSP

HRSP (Hot Router Standy Protocol)

• Cisco Propetiary
• elects gateway based on highest priority 100 is default 255 is maximum tie breaker is highest ip
• default is no preempt
• uses udp multicast 224.0.0.2 (all routers) on port 1985
• arp response contains virtual mac of 0000.0c07.acxx where xx is the group number
• can user clear text or md5 authentication
• default hello is 3 and dead 10
• speak router is router that is not elected primary or standby
• 256 hrsp groups is the limit
• It does not support ddr
• standby use bia - uses the burnt in address of the switch instead of the well known mac
• NAT is supported but can have issues when standy takes over as state table is not maintained
• In radius and tacas hrsp routers appear as 1 and the primary sends info to radius server
• it is not possible to track a gre interface
• it is possible to run hrsp for primary and secondary subnet
• hrspv2 support millisecond timers
• there is 255 groups in v1 there 4095 in v2
• hrspv2 uses a different mac 000.0c95.Fyyy where y is the group
• hrspv2 multicast to 224.0.0.12
• Supports multiple groups per interface so we can have a few groups configured and potential load balance
• can integrate with ip sla via enhance object tracking
• technically standby only needs to be configured on standby router but it should be configured on both for when the primary route comes back avalible

HRSP STATES

Initial
Listen
Speak
Standby
Active

Commands

int fa0/0
standby 1 ip 155.0.0.1
standby 1 preempt
standby 1 priority 120
standby version 1/2

sh standby

LAB

Ok so for the lab r1 will be end host with default gateway of 155.0.146.254 r4 and r6 will
use hrsp with the 155.0.146.254 being virtual default gateway

r1
---
so i am setting r1 not to do routing and to have a default gateway of 155.0.146.254
r1#config t
Enter configuration commands, one per line.  End with CNTL/Z.
r1(config)#no ip routing
*Mar  1 02:55:51.199: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 155.0.146.4
(FastEthernet0/0) is down: interface down
*Mar  1 02:55:51.203: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 155.0.146.6
(FastEthernet0/0) is down: interface down
r1(config)#
r1(config)#ip default-gateway 155.0.146.254

r4
---

i will create an acl
r4(config)#access-list 112 deny eigrp any any
r4(config)#access-list 112 deny pim?
pim
r4(config)#access-list 112 deny pim  any any
r4(config)#access-list 112 permit ip any any
this will be applied to our debug to keep it cleaner
r4#debug ip packet detail 112
IP packet debugging is on (detailed) for access list 112
r4#

r4#debug standby
HSRP debugging is on
r4#config t
Enter configurat


r4(config)#int fa0/1
r4(config-if)#standby 10 ip 155.0.146.254
r4(config-if)#
*Feb 25 10:14:46.535: HSRP: Fa0/1 Starting minimum interface delay (1 secs)
*Feb 25 10:14:46.535: HSRP: Fa0/1 Grp 10 Disabled -> Init
*Feb 25 10:14:46.535: HSRP: Fa0/1 Grp 10 Redundancy "hsrp-Fa0/1-10" state Disabled -> Init
*Feb 25 10:14:46.539: HSRP: Fa0/1 Redundancy server "hsrp-Fa0/1-10" update, Disabled -> Init
*Feb 25 10:14:46.539: HSRP: Fa0/1 Redundancy server "hsrp-Fa0/1-10" added
*Feb 25 10:14:47.535: HSRP: Fa0/1 Interface min delay expired
*Feb 25 10:14:47.535: HSRP: Fa0/1 Grp 10 Init: a/HSRP enabled
*Feb 25 10:14:47.535: HSRP: Fa0/1 Grp 10 Init -> Listen
*Feb 25 10:14:47.535: HSRP: Fa0/1 Grp 10 Redundancy "hsrp-Fa0/1-10" state Init -> Backup
*Feb 25 10:14:47.535: HSRP: Fa0/1 Redundancy server "hsrp-Fa0/1-10" update, Init -> Backup
*Feb 25 10:14:47.535: HSRP: Fa0/1 Redirect adv out, Passive, active 0 passive 1
*Feb 25 10:14:47.535: IP: s=155.0.146.4 (local), d=224.0.0.2 (FastEthernet0/1), len 44,
sending broad/multicast
*Feb 25 10:14:47.535:     UDP src=1985, dst=1985
*Feb 25 10:14:53.571: IP: s=155.0.146.1 (FastEthernet0/1), d=224.0.0.1, len 28, rcvd 0,
proto=2
*Feb 25 10:14:57.535: HSRP: Fa0/1 Grp 10 Listen: c/Active timer expired (unknown)
*Feb 25 10:14:57.535: HSRP: Fa0/1 Grp 10 Listen -> Speak
*Feb 25 10:14:57.535: HSRP: Fa0/1 Grp 10 Redundancy "hsrp-Fa0/1-10" state Backup -> Speak
*Feb 25 10:14:57.535: HSRP: Fa0/1 Redundancy server "hsrp-Fa0/1-10" update, Backup -> Speak
*Feb 25 10:14:57.535: HSRP: Fa0/1 Grp 10 Hello  out 155.0.146.4 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:14:57.535: IP: s=155.0.146.4 (local), d=224.0.0.2 (FastEthernet0/1), len 48,
sending broad/multicast
*Feb 25 10:14:57.535:     UDP src=1985, dst=1985
*Feb 25 10:14:59.667: IP: s=155.0.146.4 (local), d=224.0.1.40 (FastEthernet0/1), len 28,
sending broad/multicast, proto=2
*Feb 25 10:15:00.535: HSRP: Fa0/1 Grp 10 Hello  out 155.0.146.4 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:15:00.535: IP: s=155.0.146.4 (local), d=224.0.0.2 (FastEthernet0/1), len 48,
sending broad/multicast
*Feb 25 10:15:00.535:     UDP src=1985, dst=1985
*Feb 25 10:15:03.535: HSRP: Fa0/1 Grp 10 Hello  out 155.0.146.4 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:15:03.535: IP: s=155.0.146.4 (local), d=224.0.0.2 (FastEthernet0/1), len 48,
sending broad/multicast
*Feb 25 10:15:03.535:     UDP src=1985, dst=1985
*Feb 25 10:15:06.535: HSRP: Fa0/1 Grp 10 Hello  out 155.0.146.4 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:15:06.535: IP: s=155.0.146.4 (local), d=224.0.0.2 (FastEthernet0/1), len 48,
sending broad/multicast
*Feb 25 10:15:06.535:     UDP src=1985, dst=1985
*Feb 25 10:15:07.535: HSRP: Fa0/1 Grp 10 Speak: d/Standby timer expired (unknown)
*Feb 25 10:15:07.535: HSRP: Fa0/1 Grp 10 Standby router is local
*Feb 25 10:15:07.535: HSRP: Fa0/1 Grp 10 Speak -> Standby
*Feb 25 10:15:07.535: %HSRP-5-STATECHANGE: FastEthernet0/1 Grp 10 state Speak -> Standby
*Feb 25 10:15:07.535: HSRP: Fa0/1 Grp 10 Redundancy "hsrp-Fa0/1-10" state Speak -> Standby
*Feb 25 10:15:07.535: HSRP: Fa0/1 Redundancy server "hsrp-Fa0/1-10" update, Speak -> Standby
*Feb 25 10:15:07.535: HSRP: Fa0/1 Grp 10 Hello  out 155.0.146.4 Standby pri 100 vIP
155.0.146.254
*Feb 25 10:15:07.535: IP: s=155.0.146.4 (local), d=224.0.0.2 (FastEthernet0/1), len 48,
sending broad/multicast
*Feb 25 10:15:07.535:     UDP src=1985, dst=1985
*Feb 25 10:15:08.035: HSRP: Fa0/1 Grp 10 Standby: c/Active timer expired (unknown)
*Feb 25 10:15:08.035: HSRP: Fa0/1 Grp 10 Active router is local
*Feb 25 10:15:08.035: HSRP: Fa0/1 Grp 10 Standby router is unknown, was local
*Feb 25 10:15:08.035: HSRP: Fa0/1 Grp 10 Standby -> Active
*Feb 25 10:15:08.035: %HSRP-5-STATECHANGE: FastEthernet0/1 Grp 10 state Standby -> Active
*Feb 25 10:15:08.035: HSRP: Fa0/1 Grp 10 Redundancy "hsrp-Fa0/1-10" state Standby -> Active
*Feb 25 10:15:08.035: HSRP: Fa0/1 Redundancy server "hsrp-Fa0/1-10" update, Standby -> Active

from the output we can see that by enabling hrsp we started sending traffic to 224.0.0.2 (all
routers multicast address on source and destination of 1985 we can see we went from initial
to listen just waiting to see could we hear any other routers on the segment then we went to
speak we generated our hrsp info waiting for an election we then went into standby then into
active.

If both routers on the segement went to active you know that you have some transport issue
underlying the first thing you really should do before config ensure layer 2 connectivity
between all hrsp routers

r6
--
we can see we are recieving the hrsp related packets in

i have enabled
r6#sh run int fa0/0.146
Building configuration...
Current configuration : 149 bytes
!
interface FastEthernet0/0.146
 encapsulation dot1Q 146
 ip address 155.0.146.6 255.255.255.0
 ip pim sparse-mode
 standby 10 ip 155.0.146.254
end


Feb 25 10:38:42.475: HSRP: Fa0/0.146 Starting minimum interface delay (1 secs)
*Feb 25 10:38:42.479: HSRP: Fa0/0.146 Grp 10 Disabled -> Init
*Feb 25 10:38:42.479: HSRP: Fa0/0.146 Grp 10 Redundancy "hsrp-Fa0/0.146-10" state Disabled ->
Init
*Feb 25 10:38:42.479: HSRP: Fa0/0.146 Redundancy server "hsrp-Fa0/0.146-10" update, Disabled
-> Init
*Feb 25 10:38:42.479: HSRP: Fa0/0.146 Redundancy server "hsrp-Fa0/0.146-10" added
*Feb 25 10:38:43.475: HSRP: Fa0/0.146 Interface min delay expired
*Feb 25 10:38:43.475: HSRP: Fa0/0.146 Grp 10 Init: a/HSRP enabled
*Feb 25 10:38:43.475: HSRP: Fa0/0.146 Grp 10 Init -> Listen
*Feb 25 10:38:43.475: HSRP: Fa0/0.146 Grp 10 Redundancy "hsrp-Fa0/0.146-10" state Init ->
Backup
*Feb 25 10:38:43.475: HSRP: Fa0/0.146 Redundancy server "hsrp-Fa0/0.146-10" update, Init ->
Backup
*Feb 25 10:38:43.475: HSRP: Fa0/0.146 Redirect adv out, Passive, active 0 passive 1
*Feb 25 10:38:43.475: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 44,
sending broad/multicast
*Feb 25 10:38:43.475:     UDP src=1985, dst=1985
*Feb 25 10:38:44.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:44.267:     UDP src=1985, dst=1985
*Feb 25 10:38:44.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:44.267: HSRP: Fa0/0.146 Grp 10 Active router is 155.0.146.4
*Feb 25 10:38:44.267: HSRP: Fa0/0.146 Redirect adv out, Passive, active 0 passive 1
*Feb 25 10:38:44.267: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 44,
sending broad/multicast
*Feb 25 10:38:44.267:     UDP src=1985, dst=1985
*Feb 25 10:38:47.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:47.267:     UDP src=1985, dst=1985
*Feb 25 10:38:47.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:48.287: IP: s=155.0.67.1 (FastEthernet0/0.67), d=224.0.1.40, len 28, rcvd 0,
proto=2
*Feb 25 10:38:50.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:50.267:     UDP src=1985, dst=1985
*Feb 25 10:38:50.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:50.571: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:50.571:     UDP src=1985, dst=1985
*Feb 25 10:38:50.571: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:53.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:53.267:     UDP src=1985, dst=1985
*Feb 25 10:38:53.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:53.475: HSRP: Fa0/0.146 Grp 10 Listen: d/Standby timer expired (unknown)
*Feb 25 10:38:53.475: HSRP: Fa0/0.146 Grp 10 Listen -> Speak
*Feb 25 10:38:53.475: HSRP: Fa0/0.146 Grp 10 Redundancy "hsrp-Fa0/0.146-10" state Backup ->
Speak
*Feb 25 10:38:53.475: HSRP: Fa0/0.146 Redundancy server "hsrp-Fa0/0.146-10" update, Backup ->
Speak
*Feb 25 10:38:53.475: HSRP: Fa0/0.146 Grp 10 Hello  out 155.0.146.6 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:38:53.475: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 48,
sending broad/multicast
*Feb 25 10:38:53.475:     UDP src=1985, dst=1985
*Feb 25 10:38:56.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:56.267:     UDP src=1985, dst=1985
*Feb 25 10:38:56.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:56.475: HSRP: Fa0/0.146 Grp 10 Hello  out 155.0.146.6 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:38:56.475: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 48,
sending broad/multicast
*Feb 25 10:38:56.475:     UDP src=1985, dst=1985
*Feb 25 10:38:59.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:38:59.267:     UDP src=1985, dst=1985
*Feb 25 10:38:59.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:38:59.475: HSRP: Fa0/0.146 Grp 10 Hello  out 155.0.146.6 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:38:59.475: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 48,
sending broad/multicast
*Feb 25 10:38:59.475:     UDP src=1985, dst=1985
*Feb 25 10:39:00.535: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:39:00.535:     UDP src=1985, dst=1985
*Feb 25 10:39:00.535: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254u a
*Feb 25 10:39:02.267: IP: s=155.0.146.4 (FastEthernet0/0.146), d=224.0.0.2, len 48, rcvd 0
*Feb 25 10:39:02.267:     UDP src=1985, dst=1985
*Feb 25 10:39:02.267: HSRP: Fa0/0.146 Grp 10 Hello  in  155.0.146.4 Active  pri 100 vIP
155.0.146.254
*Feb 25 10:39:02.475: HSRP: Fa0/0.146 Grp 10 Hello  out 155.0.146.6 Speak   pri 100 vIP
155.0.146.254
*Feb 25 10:39:02.475: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 48,
sending broad/multicast
*Feb 25 10:39:02.475:     UDP src=1985, dst=1985ll
                 ^
% Invalid input detected at '^' marker.
r6(config-subif)#
*Feb 25 10:39:03.475: HSRP: Fa0/0.146 Grp 10 Speak: d/Standby timer expired (unknown)
*Feb 25 10:39:03.475: HSRP: Fa0/0.146 Grp 10 Standby router is local
*Feb 25 10:39:03.475: HSRP: Fa0/0.146 Grp 10 Speak -> Standby
*Feb 25 10:39:03.475: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Speak -> Standbye
*Feb 25 10:39:03.475: HSRP: Fa0/0.146 Grp 10 Redundancy "hsrp-Fa0/0.146-10" state Speak ->
Standby
*Feb 25 10:39:03.475: HSRP: Fa0/0.146 Redundancy server "hsrp-Fa0/0.146-10" update, Speak ->
Standby
*Feb 25 10:39:03.475: HSRP: Fa0/0.146 Grp 10 Hello  out 155.0.146.6 Standby pri 100 vIP
155.0.146.254
*Feb 25 10:39:03.475: IP: s=155.0.146.6 (local), d=224.0.0.2 (FastEthernet0/0.146), len 48,
sending broad/multicast
*Feb 25 10:39:03.475:     UDP src=1985, dst=1985xit

we can see that we go through the states but we will stick at standby realistically if we had
the election we should became hrsp active as we both default priority and r6 has the higher
ip but once a router is online as active there is no election and no preempt by default  so
like the ospf dr etc it really comes down to who boots up first

we can see from the
r6#sh standby
FastEthernet0/0.146 - Group 10
  State is Standby
    1 state change, last state change 00:05:45
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.164 secs
  Preemption disabled
  Active router is 155.0.146.4, priority 100 (expires in 8.768 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Fa0/0.146-10" (default)
r6#

that we are standby virtual ip is 155.0.146.254 active and local virtual mac is 000.0c07.ac-a
we can see our timers
we can see premption is disabled and our default priority is 100
lets change preempt
r6(config)#int fa0/0.146
r6(config-subif)#standby 10 preempt
Now we have enabled preemption we will not preempt based on highest ip it does not go through
the election process we will only preempt based on priority

r6(config)#int fa0/0.146
r6(config-subif)#standby 10 priority 110
r6(config-subif)#
*Feb 25 10:47:50.263: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Standby -> Active

higher priority is better i configured preemption and higher priority i am now in the active
state
Lets look another command
notice this command is not group specfic like the other commands
r6(config-subif)#int fa0/0.146
r6(config-subif)#standby use-bia

r6#sh standby
FastEthernet0/0.146 - Group 10
  State is Active
    2 state changes, last state change 00:02:55
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0013.80e4.901a
    Local virtual MAC address is 0013.80e4.901a (bia)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.572 secs
  Preemption enabled
  Active router is local
  Standby router is 155.0.146.4, priority 100 (expires in 9.564 sec)
  Priority 110 (configured 110)
  IP redundancy name is "hsrp-Fa0/0.146-10" (default)
r6#

notice the active virtual mac address has changed to the bia of r6 this is for situation
maybe you have port security you do not want the additional virtual mac on the port

r4
---
r4#sh st
*Feb 25 10:34:05.891: %SYS-5-CONFIG_I: Configured from console by consoleandby
FastEthernet0/1 - Group 10
  State is Standby
    4 state changes, last state change 00:03:29
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0013.80e4.901a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.432 secs
  Preemption disabled
  Active router is 155.0.146.6, priority 110 (expires in 9.432 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Fa0/1-10" (default)
r4#

r6
---
r6(config)#int fa0/0.146
r6(config-subif)#shut
r6(config-subif)#


r4
---
r4#sh standby
FastEthernet0/1 - Group 10
  State is Active
    5 state changes, last state change 00:00:34
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.384 secs
  Preemption disabled
  Active router is local
  Standby router is unknown
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Fa0/1-10" (default)
r4#
goes back to using the typical hrsp address as we did not configure the command on r4
it will send a arp reply even though it was not requested saying the new mac for
155.0.146.254 is 0000.0c07.ac0a

r6
---
i will bring backup r6 and take off use bia

r6#sh st
*Feb 25 10:57:04.951: %SYS-5-CONFIG_I: Configured from console by consoleandby
FastEthernet0/0.146 - Group 10
  State is Active
    4 state changes, last state change 00:00:45
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.372 secs
  Preemption enabled
  Active router is local
  Standby router is 155.0.146.4, priority 100 (expires in 7.368 sec)
  Priority 110 (configured 110)
  IP redundancy name is "hsrp-Fa0/0.146-10" (default)
r6#

one things we notice is the timers are quite high

r6(config)#int f0/0.146
r6(config-subif)#standby 10 timers 1 3

we can change them or we can also use bfd in here ios version my version does not currently
support

Ok I am going make r4 active so preemtion is configured the other

r4
--
on r4 i will enable preemption it is still at the defaul priority of 100 so will not preempt
r4(config)#int fa0/1
r4(config-if)#standby 10 preempt

r6
---
We will looking tracking
r6(config-subif)#int fa0/0.146
r6(config-subif)#standby 10 track fa0/1 120
r6(config-subif)#

so this basically say if r6 int fa0/1 goes down bring down my priority by 120
this would then mean that r6 has lower priority than r4 so r4 would take over as now it has
preempt configured

r6(config)#int fa0/1
r6(config-if)#shut
r6(config-if)#
*Feb 25 11:25:40.375: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Active -> Speak
*Feb 25 11:25:41.655: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to
administratively down
*Feb 25 11:25:42.655: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1,
changed state to down
*Feb 25 11:25:43.375: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Speak -> Standby

we can see this is indeed what happens

now as we know tracking interface may not be the best way to tell for upstream reachability
just because our local interface is up does not mean the service provider may have internal
issues
so another more used option is tracking with ip sla
so i will just change r6 back

r6(config)#int fa0/1
r6(config-if)#no shut
r6(config-if)#
*Feb 25 11:27:02.875: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Standby -> Active
*Feb 25 11:27:04.767: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
*Feb 25 11:27:05.767: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1,
changed state to u

so bb2 has a loopback of 11.2.2.2
r6#ping 11.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
r6#

which i can reach from r6 so lets use this
r6(config)#ip sla 1
r6(config-ip-sla)#icmp echo 11.2.2.2
r6(config-ip-sla)#icmp-echo 11.2.2.2
r6(config-ip-sla-echo)#frequency 5
r6(config-ip-sla-echo)#timeout 2000
r6(config-ip-sla-echo)#exit
r6(config)#ip sla schedule 1 start-time now life forever

r6(config)#track 2 rtr 1

r6#sh track
Track 2
  Response Time Reporter 1 state
  State is Up
    1 change, last change 00:00:32
  Latest operation return code: OK
  Latest RTT (millisecs) 1
r6#

r6(config)#int fa0/0.146
r6(config-subif)#standby 10 track 2
r6(config-subif)#standby 10 track 2 decrement 120
at the moment
r6#sh standby
FastEthernet0/0.146 - Group 10
  State is Active
    10 state changes, last state change 00:07:45
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 1 sec, hold time 3 sec
    Next hello sent in 0.032 secs
  Preemption enabled
  Active router is local
  Standby router is 155.0.146.4, priority 100 (expires in 2.008 sec)
  Priority 110 (configured 110)
    Track interface FastEthernet0/1 state Up decrement 120
    Track object 2 state Up decrement 120
  IP redundancy name is "hsrp-Fa0/0.146-10" (default)

BB2
---
bb2#config t
Enter configuration commands, one per line.  End with CNTL/Z.
bb2(config)#int lo0
bb2(config-if)#shut
bb2(config-if)#
access#5
r6
----
r6#
*Feb 25 11:35:31.895: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Active -> Speak

r6#sh standby
FastEthernet0/0.146 - Group 10
  State is Standby
    12 state changes, last state change 00:00:27
  Virtual IP address is 155.0.146.254
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 1 sec, hold time 3 sec
    Next hello sent in 0.556 secs
  Preemption enabled
  Active router is 155.0.146.4, priority 100 (expires in 2.560 sec)
  Standby router is local
  Priority 0 (configured 110)
    Track interface FastEthernet0/1 state Up decrement 120
    Track object 2 state Down decrement 120
  IP redundancy name is "hsrp-Fa0/0.146-10" (default)
r6#
*Feb 25 11:35:34.895: %HSRP-5-STATECHANGE: FastEthernet0/0.146 Grp 10 state Speak -> Standby

PROTECTED PORTS & PRIVATE VLANS

Protected Ports

• 2  Protected port  on switch in the same vlan cannot exchange l2 frame with each other
• used to prevent devices on same vlan from communicating at layer 2
•  Both port must be on the same switch for this feature to work
• You will still recieve traffic from unkown unicast and multicast 

Commands

int fa0/1
switchport protected

sh switchport protected
Private Vlans

• can work across multiple switches
• sub vlans are community or isolated
• promiscious ports can speak to all usually layer 3 interface
• community can speak to all ports in its own community and promiscious port
• isolated can only speak to promiscious port
• urpf will not work with pvlans
• the vtp mode on switches for pvlan must be transparent
• cannot include vlan 1 or 1002-1005
• does not work with etherchannel if both are configured on port pvlan superside etherchannel
• You can use span destination ports in pvlans span supersides pvlan
• you can use span source port in pvlans
• enable portfast + bpduguard on pvlan to prevent loops from misconfig
• qos is supported
• acl should not be applied to isolated or community
• dynamic acl should not be applied to primary vlan
• same config is required on all switches
• vtp v3 supports but not vtpv1 or vtpv2

Commands

vtp mode transparent
vlan 112
primary-vlan primary
private-vlan association 113 114
vlan 113
private-vlan community
vlan 114
private-vlan isolated

int fa0/1
switchport mode private-vlan promiscious
switchport private-vlan mapping 112 add 113,114,115

int fa0/5
switchport mode private-vlan host
switchport private vlan host 112 113 - so primary 112 and subvlan 112

sh vlan private-vlan


LAB
----

Protected Port
---------------

so i am configuring all the ports on s1 in the same vlan
s1(config)#int fa0/1
s1(config-if)#switchport access vlan 112
% Access VLAN does not exist. Creating vlan 112
s1(config-if)#int fa0/3
s1(config-if)#switchport access vlan 112
Command rejected: Fa0/3 not a switching port.
s1(config-if)#int fa0/5
s1(config-if)#switchport access vlan 112
s1(config-if)#

All the routers connecting in will go in 10.229.254.0/24 subnet
r1(config)#int fa0/0
r1(config-if)#ip address 10.229.254.1 255.255.255.0
r1(config-if)#

r3(config)#int fa0/0
r3(config-if)#ip address 10.229.254.3 255.255.255.0
r3(config-if)#no shut

r5(config)#int fa0/0
r5(config-if)#ip address 10.229.254.5 255.255.255.0

ok so we will have r1 r3 not able to communicate with each other but a;; communicate with r5

s1(config)#int fa0/1
s1(config-if)#switchport protected
s1(config-if)#int fa0/3
s1(config-if)#switchport protected

From R1
--------
r1#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r1#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r1#

FROM R3
--------

r3#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
r3#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r3#

From R5
--------
r5#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5#


Private VLAN
-------------
I will take the protected port of but we will keep the new address all in vlan 112 i will also do this to the routers connected to sw2 r2,r4,r6
10.229.254.2 and 10.229.254.4 and 10.229.254.6 all in vlan 112

routers
--------

r2(config)#int fa0/0
r2(config-if)#ip address 10.229.254.2 255.255.255.0
r2(config-if)#

r4(config)#int fa0/0
r4(config-if)#ip address 10.229.254.4 255.255.255.0
r4(config-if)#

r6(config)#int fa0/0
r6(config-if)#ip address 10.229.254.6 255.255.255.0
r6(config-if)#

switch 2
---------

s2(config)#int fa0/2
s2(config-if)#switchport mode access
s2(config-if)#switchport access vlan 112
s2(config-if)#int fa0/4
s2(config-if)#switchport mode access
s2(config-if)#switchport access vlan 112
s2(config-if)#int f0/6
s2(config-if)#switchport mode access
s2(config-if)#switchport access vlan 112
ok as per lab diagram r1 is going promicious will able to connect to everyone r3 + r2 will able to connect to each other and r1  r5 and r4 will able to
connect to each other and r1
r6 will only able to connect to r1 they will all be in the same main vlan


We will start the config on s1
first things first put the vtp mode to transparent

s1(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
create the vlans
s1(config)#vlan 112
s1(config-vlan)#private-vlan primary
s1(config-vlan)#vlan 113
s1(config-vlan)#private-vlan community
s1(config-vlan)#vlan 114
s1(config-vlan)#private-vlan community
s1(config-vlan)#vlan 115
s1(config-vlan)#private-vlan isolated
s1(config-vlan)#

s1(config)#vlan 112
s1(config-vlan)#private-vlan association 113,114,115

this same config needs to be put on s2

S2
---
s2(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
s2(config)#vlan 112
s2(config-vlan)#  private-vlan primary
s2(config-vlan)#  private-vlan association 113-115
s2(config-vlan)#!
s2(config-vlan)#vlan 113
s2(config-vlan)#  private-vlan community
s2(config-vlan)#!
s2(config-vlan)#vlan 114
s2(config-vlan)#  private-vlan community
s2(config-vlan)#!
s2(config-vlan)#vlan 115
s2(config-vlan)#  private-vlan isolated

s1
---
we will start with inteface fa0/1 setting as the promiscious port
s1(config)#int fa0/1
s1(config-if)#switchport mode private-vlan promiscuous
s1(config-if)#switchport private-vlan mapping 112 add 113,114,115

now on to the community ports
so for r3 in community vlan 113

s1(config-if)#int fa0/3
s1(config-if)#switchport mode private-vlan host
s1(config-if)#switchport private-vlan host 112 113
for r5 in community vlan 114
s1(config)#int fa0/5
s1(config-if)#switchport mode private-vlan host
s1(config-if)#switchport private-vlan host 112 114

S2
---
for r2 in community vlan 113

s2(config)#int fa0/2
s2(config-if)#switchport mode private-vlan host
s2(config-if)#switchport private-vlan host 112 113

for r4 in private vlan 114
s2(config)#int fa0/4
s2(config-if)#switchport mode private-vlan host
s2(config-if)#switchport private-vlan host 112 114
for r6 who is in the isolated vlan
s2(config)#int fa0/6
s2(config-if)#switchport mode private-vlan host
s2(config-if)#switchport private-vlan host 112 115

ok lets test the config

r1
---
r1#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/4 ms
r1#ping 10.229.254.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
r1#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r1#ping 10.229.254.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
r1#

can ping everything


r5
---
r5#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5#ping 10.229.254.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
r5#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r5#ping 10.229.254.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r5#

it can ping it fellow community member r4 and the promiscious port but not memeber from other communties or isolated group

r6
---
r6#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r6#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r6#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
..

can only ping r1 which is what was expected

say i decided r4 should not be in community but be isolated


s2(config-if)#switchport private-vlan host 112 115
s2(config-if)#exit
s2(config)#do sh run int fa0/4
Building configuration...
Current configuration : 146 bytes
!
interface FastEthernet0/4
 switchport access vlan 112
 switchport private-vlan host-association 112 115
 switchport mode private-vlan host
end
s2(config)#

it is using the same vlan id as r6 115

r4#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r4#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
r4#ping 10.229.254.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

it can not ping it ex community member it can ping the promicious port
it cannot ping r6 even though they are in the same secondary vlan meaning we can use the
same secondary isolated vlan over and over

ADDITIONAL LAYER 2 SECURITY

ADDITIONAL LAYER 2 SECURITY


DHCP SNOOPING

• This is a way of enforcing the dhcp server role on ports.
• The potential issue that dhcp snooping is that a man in the middle attack on the dhcp.
• The way dhcp works is that dhcp request (broadcast) is sent out by the host onto the segement the router on the segement will usually configured to pass this broadcast to dhcp server the dhcp server then unicast back a dhcp offer with the  ip address on offer etc.The client will  sent back dhcprequest(broadcast) saying it would like to reserve this and the dhcp server replies with unicast dhcppack As we see the initial request is broadcast so other devices on the segment recieve this. So this what DHCP attack could be is that you would setup a DHCP server on the segment when the broadcast is recieved you will send back the offer the router will go with the first dhcp server that responds back so the ogue dhcp server sends an offer setting itself as the default gateway.
• So DHCP snooping will validate dhcp message from untrusted source ports and filter out messages. So if dhcp offer is coming out an access port that is not the dhcp server if dhcp snooping is enabled it will filter this
• DHCP snooping will only allow trusted ports respons to dhcp request broadcast. So you would set your user acccess ports to untrusted and your uplink towards the designated dhcp server as trusted so only offers can comes in trusted ports.
• Also when you enable dhcp snooping it creates the dhcp database which will keep track of your mac to IP to port bindings. This is also used by other security features
• it can also rate limit dhcp traffic from trusted and untrusted port
• it is enabled on per vlan basis
• if dhcp mac verification os on the snooping check the source mac and dhcp client hardware address if they do not match it is not allowed

DHCP SNOOPING CAVEATS

• Do not forget to trust port to dhcp server
• in multiswitch scenerio trust trunk links
• keep in mind that dhcp snooping inser option 82 information option into packet some servers do not support this if it is the case you can disable it

no ip dhcp snooping information-option

• Alternatively configure server to trust empty giaddress

Commands

ip dhcp snooping
ip dhcp snooping vlan 146
int fa0/1
ip dhcp snooping trust

all other ports in vlan 146 are set to untrusted


LAB

S4
---
so i have switched vlan snooping on and added vlan 146
s4(config)#ip dhcp snooping
s4(config)#ip dhcp snooping vlan 146
s4#sh ip dhcp snoop
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
146
DHCP snooping is configured on the following Interfaces:
Insertion of option 82 is enabled
   circuit-id format: vlan-mod-port
    remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Interface                    Trusted     Rate limit (pps)
------------------------     -------     ----------------
s4#

ok so i will enable a trusted interface where the dhcp server is

s4(config)#int fa0/1
s4(config-if)#ip dhcp snooping trust

s4#sh ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
146
DHCP snooping is configured on the following Interfaces:
Insertion of option 82 is enabled
   circuit-id format: vlan-mod-port
    remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Interface                    Trusted     Rate limit (pps)
------------------------     -------     ----------------
FastEthernet0/1              yes         unlimited
s4#

that is really all that is required you just need to watch out if the dhcp server is not connected trust the trunk links
watch out for the option 82 particular if using cisco ios as dhcp server it does not support so you need to disable option 82

s4(config)#no ip dhcp snooping information option

Dynamic ARP Inspection (DAI)

• This is in response to arp poisoning attack. So the attack is that a client will arp out for the mac of the default gateway as per normal The rogue attacker will reply back saying i have the default gateway ip and my mac is this. The user will then forward the packets at layer 2 to the rogue device again the attacker will most likely forward the packets on to the legitmate default gateway so the attack becomes transparent to the user they do not know that it is happening
• ARP inspection (DAI) is way of dealing with this type of attack It inspects arp request+ response and compare them to the dhcp snooping database if it is conflict with this the arp is ignored
• There is a second part to this if dhcp snooping or dhcp is not been used i.e we are using static mapping we could configure statically the arp address for the default gateway
• static is preffered over dynamic

Commands

ip arp inspection vlan 146

int fa0/1
ip arp inspection trust

Static config
arp access-list
permit ip host 10.229.254.1 mac host 0000.0000.000.0001

we apply to the vlan

ip arp inspection filter 'myfilter' vlan 146


LAB

we will look at the config for both scenerios
for Dynamic with dhcp address
s4(config)#ip arp inspection vlan 146
this willl enable inspection for arp request responses on the segment it will check the dhcp database for binding for port to mac to ip

we will configure our trunks to be trusted as this will carry multiple macs for multiple vlans

s4(config)#int fa0/4
s4(config-if)#ip arp inspection trust

for the static mappings
------------------------
We do not have the dhcp binding entry for statically assigned addresses so we can manually create a entry for the inspection to use
we use and arp access-list
s4(config)#arp access-list MYFILTER
s4(config-arp-nacl)#permit ip host 10.229.254.1 mac host 0000.0000.0001

we apply this to the vlan with
s4(config)#ip arp inspection filter MYFILTER vlan 146


IP SOURCE GUARD

• Prevents IP address Spoofing
• Same concept as arp inspection but at layer 3
• Uses the dhcp snooping database to filter ip on the port dynamically
• Port secuirty must be enabled
• Ip source guard is not supported on etherchannels

Commands
ip verify source (interface command)
Mac address filtering could also be enforced
Requires port security enable on interface
additinal paramters

ip verify souce port security

static ip to mac mapping on vlan
ip source binding (global comman

SNMP & RMON

SNMP & RMON


SNMP

• runs over udp ports 161/162 - non reliable
• Mangement information base- used to read/write variables in device config
• Network Management station (NMS) asks managed device the status of the MIB. This is called SNMP Polling
• Managed device may also report unsolicted events called SNMP Traps or informs - difference been informs require ack

SNMP VERSIONS

3 main versions
v1- supports only community authentication
v2c- supports community authentication and views
v3- support users/groups - encryption and secure authentication

SNMPv1/2c

Configured as snmp-server community {string} {ro|rw} {acl}
community string
   - clear text passwords for NMS to poll device
2 types of community strings
   - read only
   - read write
ACL defines who can poll device

SNMP Traps

Device reports unsolicted events to NMS
Reports could be
   - unreliable- traps
   - reliable- informs
   - both are sent using UDP to port 162
SNMP V1/V2
-----------
Define events to trap
All traps
snmp-server enable traps
specfic
snmp-server enable traps {notification-type}
Define a host to send the traps to

all Enabled traps
  snmp-server host "host addr community-string"
subset of enabled traps
snmp-server host " host add community-sting {notification type}

A common mistake is to define the hosts but not actual enable the traps globally i.e skipping
step 1

sh snmp ifmib ifindex - this is a good command to look at what assigned index was givn to a  
                      particular interface. IFindex can change when new interfaces come on
                        line new interface include sub interface and loopback in order to
                        keep persistent values for assigned interfaces we can use the command
snmp=server ifindex persist
sh snmp mib- will give you a list of all possible mibs some are hard to decipher what they do
             from the name there is snmp mib translator on the net to assist

SNMP V3
--------
3 main entites
Users- operators accessing the routers
Groups - group users access privilges is then asssigned to groups
Views - define subset of mib visible to groups
so it sort similar to windows group you put a user in a group and group then is assigned
access to the view


SNMPV3 Security
----------------
Access to mib is either
    - unauthenticated/unencrypted - No AuthNoPRiv
    - authenticated only - AuthnoPriv
    - authenticated and encrypted - AuthPriv
SNMPv3 Traps
------------
Support traps/informs
AUthentication model is different
Traps need to have a user associated
User credentials are used to authenticate
The nms need to implement authentication


RMON
-----
Remote Monitoring
  - used to monitor MIB variables
Monitoring has two components
   - alarm
      condition to trigger events
   -event
      action to associate to alarm
      normally a syslog/snmp trap


RMON ALarm
-----------
Rmon alarm defines how mib is sampled
you have 2 types

1) DELTA sampling- used for variables that accumalted like packet counter,crc errror these
vairiable never go down always up. Having just a value for these is not much use as it is
hard to decipher the time period the value was obtained. WHat delta gives you is the
difference in each time period so like if you get syslog saying you have had 6 crc errrors on
interface in the last 10 minutes is alot easier to act on then just getting you had 6 crc
ever.
_ difference between MIB value at time index a compared to time index B
- Used for values that only increase/accumalate
- Tracks rate of change for variable
-Sampling intervals define the time period
2) ABosulute sammpling- Is for exact match of the MIB at time of index A
  You use this for values that are going go up and down and for variables that just given the
value at that specfic is going be useful for example
CPU Utilization memory utilization error % on interfaces size of routing table
Used for values that increase and decrease

The parser will not guide you to say you should use this variable with delta so you neeed to
look at it and think about it in general if it variable that just goes up - delta if it
variable that goes up and down- abosulute
 
LAB
----
FOR SNMPV1/V2

First we will define our polling
we will define a subnet that has access
r4(config)#ip access-list standard EIGRP-SNMP
r4(config-std-nacl)#permit 192.168.1.0 0.0.0.255
r4(config-std-nacl)#

r4(config)#snmp-server community EIGRP-SNMP-COM ro EIGRP-SNMP


Next in global config we need to enable our traps

r4(config)#snmp-server enable traps ?
  atm                Enable SNMP atm traps
  authenticate-fail  Enable SNMP 802.11 Authentication Fail Trap
  bgp                Enable BGP traps
  bstun              Enable SNMP BSTUN traps
  bulkstat           Enable Data-Collection-MIB Collection notifications
  cnpd               Enable NBAR Protocol Discovery traps
  config             Enable SNMP config traps
  config-copy        Enable SNMP config-copy traps
  cpu                Allow cpu related traps
  deauthenticate     Enable SNMP 802.11 Deauthentication Trap
  disassociate       Enable SNMP 802.11 Disassociation Trap
  dlsw               Enable SNMP dlsw traps
  dot11-qos          Enable SNMP 802.11 QoS Change Trap
  ds0-busyout        Enable ds0-busyout traps
  ds1                Enable SNMP DS1 traps
  ds1-loopback       Enable ds1-loopback traps
  dsp                Enable SNMP dsp traps
  eigrp              Enable SNMP EIGRP traps
  entity             Enable SNMP entity traps
  envmon             Enable SNMP environmental monitor traps
  event-manager      Enable SNMP Embedded Event Manager traps
  firewall           Enable SNMP Firewall tra
this is partial list we can enable traps based on specfic technologies etc rather than all
traps
this would be for eigrp info
r4(config)#snmp-server enable traps eigrp

if i wanted all trap i would use the below
r4(config)#snmp-server enable traps

next we define the host to send traps to

r4(config)#snmp-server host 192.168.2.1 EIGRP-SNMP-COM eigrp

so this server would be sent the traps for eigrp

sh snmp mib will show you all the preconfigured mibs availible to use
if we are looking at interfaces
r4#sh snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Loopback0: Ifindex = 8
Null0: Ifindex = 5
Serial0/0/0: Ifindex = 3
Async2: Ifindex = 6
FastEthernet0/1: Ifindex = 2
Serial0/1/0: Ifindex = 4
Async18: Ifindex = 7
r4#
and we want to keep the index persistent for our logging of particular interfaces

r4(config)#snmp-server ifindex pers

SNMP V3
-------

FIrst we create our view
r4(config)#snmp-server view MYVIEW cisco included
create the group
r4(config)#snmp-server group MYGOUP v3 priv read MYVIEW

Create the user
snmp-server user MYUSER MYGROUP v3 auth md5 PASSWORD priv 3des SECRETKEY
so we have created a user who will be in the group MTGROUP with md5 authentication and
encyption of 3des


define a trap
r4(config)#snmp-server host 192.168.2.1 trap version 3 auth MYUSER eigrp

RMON
-----
OK i will do rmon on interface f0/1 for an alarm for if we get 1000 packets in  60 seconds

r4#sh snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Loopback0: Ifindex = 8
Null0: Ifindex = 5
Serial0/0/0: Ifindex = 3
Async2: Ifindex = 6
FastEthernet0/1: Ifindex = 2
Serial0/1/0: Ifindex = 4
Async18: Ifindex = 7
r4#

r4#sh run
*Feb 24 13:11:08.895: %SYS-5-CONFIG_I: Configured from console by console| inc rmon
rmon alarm 1 ifOutUcastPkts.2 60 delta rising-threshold 1000 2 falling-threshold 1 3 owner
config
r4#

ok so this command is saying the first rmon alarm we will check interface output unicast
packets it is for the ifindex 2 so that is fa0/1 delta rising value is 100 packets so this
trigger it if this happens we will use alarm 2 the falling-treeshold is 1 packet and will
trigger alarm 3

we now need to define the event
r4(config)#rmon event 2 log description interface-fa0/1-over-100ppm
so for event 2 we will get a log saying interface-fa0/1-over-100ppm

for alarm 3

r4(config)#rmon event 3 log description interface-fa0/1-is-not-transmitting

r4#sh rmon alarms
Alarm 1 is active, owned by config
 Monitors ifOutUcastPkts.2 every 60 second(s)
 Taking delta samples, last value was 6
 Rising threshold is 1000, assigned to event 2
 Falling threshold is 1, assigned to event 3
 On startup enable rising or falling alarm
r4#

r4#
*Feb 24 13:23:01.855: %RMON-5-RISINGTRAP: Rising trap is generated because the value of
ifOutUcastPkts.2 exceeded the rising-threshold value 1000

r4#sh rmon alarms
Alarm 1 is active, owned by config
 Monitors ifOutUcastPkts.2 every 60 second(s)
 Taking delta samples, last value was 1106
 Rising threshold is 1000, assigned to event 2
 Falling threshold is 1, assigned to event 3
 On startup enable rising or falling alarm
r4#

LAYER 2 SECURITY

LAYER 2 SECURITY FEATURES


Port Security

• Default violate mode shutdown,protect (do not allow),restirct(do not allow + generate a log)
• if port is shutdown all dynamically learnt mac address are removed
• if using a phone set maximum to at least 2 1 for pc and 1 for phone
• aging can be used to age out mac address
• default allowed mac addresses is 1
• you can enable port security on a trunk
• port secuirty supports pvlan ports
• supports 802.1q tunnel ports
• does not support span destination ports
• only supports nonegotiate trunks
• flex link and port security are not compatiable
• keep in fhrp like hrsp vrrp glbp they use virtual macs

Commands

int fa0/1

switchport port-security mac-address sticky/"48 bit mac"

switchport port-security maximum 1

switchport port-secuirty aging "minutes"

switchport port security violation " shutdown/protect/restrict"

LAB


OK so I am on s4 which has r4 connected on it fa0/4 int it is not trunk but just access port
s4>en
s4#sh mac address-table dynamic int fa0/4
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 146    0012.d993.728d    DYNAMIC     Fa0/4
Total Mac Addresses for this criterion: 1
s4#

s4(config)#int fa0/4
s4(config-if)#switchport port-security
s4(config-if)#switchport port-security ?
  aging        Port-security aging commands
  mac-address  Secure mac address
  maximum      Max secure addresses
  violation    Security violation mode
  <cr>
s4(config-if)#switchport port-security violation protect

s4(config-if)#switchport port-security maximum 1
s4(config-if)#switchport port-security mac-address ?
  H.H.H   48 bit mac address
  sticky  Configure dynamic secure addresses as sticky
s4(config-if)#switchport port-security mac-address sticky

s4#sh run int fa0/4
Building configuration...
Current configuration : 260 bytes
!
interface FastEthernet0/4
 switchport access vlan 146
 switchport mode access
 switchport port-security
 switchport port-security violation protect
 switchport port-security mac-address sticky
 switchport port-security mac-address sticky 0012.d993.728d
end

notice it dynamically learns the mac and puts it in the running config as i specfied sticky i
could alternatively by just doing

switchport port-security mac-address "mac"
s4#sh port-security int fa0/4
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Protect
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0012.d993.728d:146
Security Violation Count   : 0
s4#

one of things to note that the mac asssigned to the port will not age out as it set to
abosulte so unless the port goes down it will not age out the mac if want to put in aging
s4(config-if)#switchport port-security aging time 30
it is in minutes so that is 30 mins

On trunk link fa0/13

s4(config)#int fa0/13
s4(config-if)#switchport port-security ?
  aging        Port-security aging commands
  mac-address  Secure mac address
  maximum      Max secure addresses
  violation    Security violation mode
  <cr>
s4(config-if)#switchport port-security
s4(config-if)#
00:24:53: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/13, putting Fa0/13 in
err-disable state
00:24:53: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC
address 0011.bb89.6e43 on port FastEthernet0/13.
00:24:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEtherne
the minute i put it on it shut it down as the default is 1 mac and default violate mode is
shutdown

s4(config)#int fa0/13
s4(config-if)#switchport port-security max 65
s4(config-if)#shut
s4(config-if)#no shut

s4#sh port-security int fa0/13
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 65
Total MAC Addresses        : 33
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0011.bb89.6e15:1
Security Violation Count   : 0
s4#sh port-security int fa0/13
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 65
Total MAC Addresses        : 35
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0011.bb89.6e42:67
Security Violation Count   : 0

we are on 35 at the moment

Static CAM Enteries

• Switches learn mac adddress dynamically from traffic flow it takes the source mac we can disabl this and decide to statically populate the cam table in very secure access

layer enviorments

LAB

I removed the above config

to put static entry
s4(config)#mac address-table static 0012.d993.728d vlan 146 int fastethernet0/4

no mac address-table dynamic vlan 146 - to disable  dynamically learning mac

Storm Control

• Storm Control is like like policing at layer 2
• You can limit the amount of unicast/broadcast/multicast accepted in port
•  ingress rate limiting only
• A caveat of storm control Violating multicast rate will affect and suppress unicast broadcast + multicast
• A violate in unicast will only affect unicast
• A violate in broadcast will only affect broadcast
• Also anothe caveat is %  is of the interface not the bandwidth. So it is percent of the negotiated speed so if for some reason you negotiated 10 mbs on 100 mbs link it % of 10 mbs
• You can configure traffic storm control on an EtherChannel (a port channel interface).
• Do not configure traffic storm control on ports that are members of an EtherChannel.
• Configuring traffic storm control on ports that are configured as members of an EtherChannel puts the ports into a suspended state.
• Storm Control uses rising and falling threshold. The rising threshold is if the number you need to go above before dropping will start the falling threshold is the number you need to go below to retrainsmit so the sample interval is a second so if you go above the rising threshold it will start dropping if in the next second you are below the rising threshold but above the falling threshold it will continue to block once you go below the falling threshold it will start retrainsmitting and you will need to go above the rising threshold for the process to start again

LAB

s4(config-if)#int fa0/4
s4(config-if)#storm-control broadcast level 2 1  - 2 is the high rate 1 is the low rate

s4#sh storm
Interface  Filter State   Upper        Lower        Current
---------  -------------  -----------  -----------  ----------
Fa0/4      Forwarding       2.00%        1.00%        0.00%
s4#



802.1X Authentication

• Autthenticates a port by requesting credentials from attached host
• uses EAP over lan protocol _ switch relay authentication packets to radius server
• Your end client must support eap
• you also need aaa and a radius server configured on your network
• force authorized disables 802.1x on a port
• force unauthorized - disables the port authentication will not even take place it will go into un authorized

Commands
s4(config)#aaa new-mode
s4(config)#aaa authentication dot1x default group radius
s4(config)#radius-server host 1.2.3.4 key PASSWORD

to enable 802.1x gloabally
s4(config)#dot1x system-auth-control

Then on interface

s4(config)#int fa0/4
s4(config-if)#dot1x port-control auto

PACL

• applies to layer 2 port only on incoming direction
• filter transit traffic only
• can be a ip or mac match

Commands

S4(config)#access-list 101 deny icmp 4.4.4.4 0.0.0.0 1.1.1.1 0.0.0.0
s4(config)#access-list 101 permit ip any any
s4(config)#int fa0/4
s4(config-if)#ip access-group 101 in

r4#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r4#ping 1.1.1.1 source 4.4.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 4.4.4.4
.....
Success rate is 0 percent (0/5)
r4#

ROUTED ACL

Same as pacl but only apply on l3 interface like routed port or svi
can be applied in both directions but can only filter on ipv4 standard/extended ACL not layer
2 acl

VACL

• VLan ACL or Vlan map
• Appy to a vlan/svi effective for all ports in the vlan
• if acl applied to router interface in the vlan and vlan acl. The vlan acl is checked first
• TCP intercept + reflexive acl take precendence over vlan acl
• vacl+ cbac can not be configured on the same interface

Commands
vlan access-map "Name"
match ip address 101
action drop
vlan access-map "Name" 20
match mac address 'name'
action drop

access-list 101 permit tcp any any eq 23
mac-access-list exteneded "name"
permit host 0012.d9993.7289 host 0013.80e4.901a

To apply to vlan

vlan-filter "nameofaccessmap" vlan-list 146
LAB
----
ok SO We will apply vlan access-map to deny telnet to anywhere on the vlan ports and also
deny traffic to r6 from r4
r4
---
s4(config)#access-list 101 permit tcp any any eq 23
s4(config)#mac access-list extended TRAFFIC
s4(config-ext-macl)#permit host 0012.d993.728d host 0013.80e4.901a

we will create the vlan access-map matching the mac access-list and the extended ip access
list for these it will drop for everything else it will forward

s4(config)#vlan access-map FILTER
s4(config-access-map)#match ip address 101
s4(config-access-map)#action drop
s4(config-access-map)#exit
s4(config)#vlan access-map FILTER 20
s4(config-access-map)#match mac address TRAFFIC
s4(config-access-map)#action drop
s4(config-access-map)#exit
s4(config)#vlan access-map FILTER 30
s4(config-access-map)#action forward
s4(config-access-map)#

to apply it to vlan 146
s4(config)#vlan filter FILTER vlan-list 146