Chapter 11 Switching and Virtual LANs

Why do we use Switches and Bridges instead of routers

Layer 2 switches and bridges are faster than routers because they don't take up time looking at the Network layer header information. Instead, they look at the frame's hardware addresses before deciding to forward, flood, or drop the frame.

What are the three switch functions at layer 2?

Address learning

Forward/filter decisions

Loop avoidance

Address Learning

Layer 2 switches and bridges are capable of address learning; that is, they remember the source hardware address of each frame received on an interface and enter this information into a MAC database known as a forward/filter table.

Forward/Filter Table

A dynamic table that maps MAC addresses to switch ports.

Foward/Filter Decisions

if the destination hardware address is known (listed in the database), the frame is sent out only the specified exit interface.

Frame FIltering

When a switch does not transmit the frame out any interface except the destination interface. This is done to preserve bandwidth on other network segments.

Loop Avoidance

Term that typically refers to the Spanning Tree Protocol (STP) to stop loops in a switched network. Routing protocols, such as RIP and EIGRP, have Layer 3 loop avoidance schemes as well.

Spanning Tree Protocol (STP).

main task is to stop network loops from occurring on your layer 2 network (bridges or switches). It achieves this feat by vigilantly monitoring the network to find all links and making sure that no loops occur by shutting down any redundant ones.

Spanning Tree Algorithm (STA)

creates a topology database and then search out and destroy redundant links.

Spanning Tree Port States (Hint 5 states)

The ports on a bridge or switch running STP can transition through five different states:

Blocking

Listening

Learning

Forwarding

Disabled

Blocking

A blocked port won't forward frames, it will only listend to bridge protocol data units (BPDU) and drop all other frames. The purpose of the blocking state is to prevent the use of looped paths.

Listening

The port listens to bridge protocol data units (BPDUs) to make sure no loops occur on the network before passing data frames. Frames forwarded in this state do not populate the MAC address table.

Learning

The switch port listens to bridge protocol data units BPDUs and learns all the paths in the switched network. A port in learning state populates the MAC address table but doesn't forward data frames.

Forwarding

The port sends and receives all data frames on the bridged port. If the port is still a designated or root port at the end of the learning state, it enters the forwarding state. (Has the best(lowest) cost to the root bridge)

Disabled

A port in the disabled state (administratively) does not participate in the frame forwarding or STP. A port in the disabled state is virtually nonoperational.

What breaks up collision domains by default?

Switches

What breaks up broadcast domains by default?

Routers

Virtual Local Area Network

a logical grouping of network users and resources connected to administratively defined ports on a switch.

Flat network

A layer 2 switch network, in this configuration, every broadcast packet transmitted is seen by every device on the network regardless of whether the device needs to receive that data or not. Called flat network because its one broadcast domain.

Quality of Service (QoS)

The way the resources are controlled so that the quality of services is maintained.

It's basically the ability to provide a different priority for one or more types of traffic over other levels; priority is applied to different applications, data flows, or users so that they can be guaranteed a certain performance level.

Static Virtual Local Area Network

Virtual Local area network where each switch port is manually assigned by an administrator. It is the most common and secure way to create a virtual local area network. This security stems from the fact that any switch port you've assigned a VLAN association to will always maintain it unless you change the port assignment manually.

Dynamic Virtual Local Area Network

a virtual local area network where the host VLAN are automatically assigned. Using intelligent management software, you can base VLAN assignments on hardware (MAC) addresses, protocols, or even applications that work to create dynamic VLANs.

Dynamic Trunking Protocol (DTP)

operate on a per-port basis to set the switch port mode. DTP does this by negotiating with the port on the other end of the link.

Access Port

An access port belongs to and carries the traffic of only one VLAN. Anything arriving on an access port is simply assumed to belong to the VLAN assigned to the port.

Trunk Port

The interface on a switch capable of managing traffic from multiple VLANs.

A trunk link is a 100 Mbps or 1000 Mbps point-to-point link between two switches, between a switch and router, or even between a switch and server, and it carries the traffic of multiple VLANs—from 1 to 4,094 VLANs at a time.

Virtual Local Area Network Trunking Protocol (VTP)

are to manage all configured VLANs across a switched internetwork and to maintain consistency throughout that network. VTP allows you to add, delete, and rename VLANs—and information about those actions is then propagated to all other switches in the VTP domain.

Port Security

you can limit the number of MAC addresses that can be assigned dynamically to a port, set static MAC addresses, and—here's my favorite part—set penalties for users who abuse your policy!

Dynamic Host configuration Protocol (DHCP) snooping

a switch feature that can help to prevent your devices from communicating with illegitimate dynamic host configuration protocol DHCP servers.

When enabled, DHCP snooping allows responses to client requests from only DHCP servers located on trusted switch ports (which you define).

When enabled, DHCP snooping allows responses to client requests from only DHCP servers located on trusted switch ports (which you define).

Address Resolution Protocol (ARP) Inspection

a feature that, when configured, uses the dynamic host configuration protocol (DHCP) snooping database of IP address-to-MAC address mappings to verify the MAC address mappings of each frame going through the switch. In this way, any frames with incorrect or altered mappings are dropped

Flood Guard

A method of thwarting flood attacks. It uses two mechanisms to accomplish this: unknown unicast flood blocking (UUFB) and unknown unicast flood rate-limiting (UUFRL). The UUFB feature blocks unknown unicast and multicast traffic flooding at a specific port, only permitting egress traffic with MAC addresses that are known to exist on the port. The UUFRL feature applies a rate limit globally to unknown unicast traffic on all VLANs.

Port Channeling/Bonding

refers to combining two to eight Fast Ethernet or Gigabit Ethernet ports together between two switches into one aggregated logical link to achieve more bandwidth and resiliency.

Port Mirroring / Switch Port Analyzing (SPAN)

allows you to sniff traffic on a network when using a switch.