Objectives:

Switches forward frames based on the Layer 2 Ethernet MAC addresses. These devices receive Ethernet frames transmitted from other devices and dynamically build a MAC address table based on the source MAC address inside those frames. This MAC address table is commonly referred to as a Content Addressable Memory (CAM) table.

These dynamic entries in the CAM table are not permanent, however. After the switch or bridge stops receiving frames from a certain MAC address (this varies, but it’s typically five minutes), the entry is removed from the CAM table to save memory and processor resources. The exceptions to this are static MAC entries that have been manually configured on a port-by-port basis for security and control purposes.

When deciding to which port to forward the Ethernet frame, a switch consults this CAM table and forwards the Ethernet frame based on the destination MAC address of the Ethernet header. In instances where the destination MAC address is not in the table, it copies and forwards the frame out every port except the one at which it was received. This action is commonly known as flooding.

Recall that switches segment LANs into collision domains; however, they still are in a single broadcast domain. Switches do not have entries for broadcast addresses (FFFF.FFFF.FFFF) or multicast addresses (0100.5E00.000-0100.5E7F.FFFF) in their CAM tables. As previously mentioned, when a bridge or a switch receives a frame with a destination MAC address not in its table, it floods that frame out every port.

For instance, consider the switched topology example illustrated in Figure 13.1. When Computers A, B, and C and Printer D originally sent an Ethernet frame, the switch recorded the source MAC address of that frame and the associated port in its CAM table. If Computer A sends an Ethernet frame destined for Printer D’s MAC address of 1111.2222.3333, the switch forwards only that frame out to its Fast Ethernet 0/14 interface. If Computer A sends a broadcast with a destination of FFFF.FFFF.FFFF, that entry does not exist in the CAM table, so that frame is flooded out all interfaces except for Fast Ethernet 0/1.

Figure 13.1. Switch address learning and forwarding.

Notice that Computers B and C are plugged into a hub. So what happens when Computer B sends an Ethernet frame to Computer C? The frame hits the Layer 1 hub, which regenerates the signal out all ports except the one it came in on (regardless of the MAC address because it is a Physical layer device). When the frame reaches the switch, the switch realizes that the source and destination MAC addresses reside on the same interface, so it does not send that frame on to any other ports. This process is also commonly known as filtering.

Properly named, the store-and-forward method of frame transmission involves the switch, which buffer (store temporarily in a small memory location) the entire Ethernet frame and perform a cyclic redundancy check (CRC) of that frame to make sure it is not a corrupted frame (damaged or abnormally changed in the frame’s transmission). If the frame calculation detects a bad frame, it is dropped at that point. Thus, the frame is forwarded only if the CRC calculation results in a normal frame.

Because the entire frame is checked, store-and-forward switching is said to be latency (delay) varying. In other words, depending on the payload inside the frame, the switch takes varying processing times to buffer the entire frame and perform the CRC before sending it to its destination. Although this method sounds like a lengthy process, this is the most widely used method of switching in Cisco Catalyst switches because the hardware processors for the interfaces are so advanced and robust that the switch hardly works up a sweat.

Cut-through transmissions are practically the antithesis of store-and-forward frame transmission. In fact, instead of processing the entire frame, cut-through switching entails the switch buffering just enough information to know where to forward the frame before sending it on to another segment. In other words, it looks only up to the destination MAC address in the Ethernet header and sends it on regardless of whether the frame contains errors.

This hot-potato method of frame transmission was once appealing for devices with low processing power. Because it has to inspect only the beginning of an Ethernet frame header, latency is not a factor with this method. The downside of cut-through switching, however, is that it still passes bad frames on to other segments because it does not perform CRC calculations of any kind.

In a true Goldilocks fashion, if cut-through is too hot and store-and-forward is too cold, fragment-free may be just right for you. Fragment-free is a hybrid of the two transmission methods because it buffers up to the first 64 bytes of a frame (all collisions occur within the first 64 bytes). This obviously is not as fast as cut-through; nevertheless, it ensures that many of the invalid frames in the LAN are not transmitted on to other segments. Figure 13.2 illustrates how much of an Ethernet frame is buffered and processed with each of the three transmission methods discussed.

Figure 13.2. Frame transmission comparison.

As previously mentioned, STP performs an election in the switched topology. The winner of this election serves as the base of all calculations and ultimately becomes the root to the spanning tree. Conveniently, this elected bridge or switch is called the root bridge. From the root bridge, noncircular branches extend throughout the switched network like those of a tree—a spanning tree.

So how does this election take place? You can rule out voting because each bridge or switch believes itself to be the root bridge at startup. The deciding factor on who becomes the root bridge is something referred to as the Bridge ID. The Bridge ID comprises two components:

The device with the lowest Bridge ID becomes the root bridge. If a new switch or bridge is added with a lower Bridge ID to the switched network, a new election takes place, and that switch ultimately becomes the new root bridge for the switched network.

Consider the example shown in Figure 13.4. Notice that all switches have their default priority value of 32768 in their Bridge IDs. Thus, the lowest MAC address ultimately dictates who will win the election. Because Switch A has the lowest MAC address in the switched network, it will be the root bridge.

Figure 13.4. Root bridge election.

Because this election process occurs automatically with bridges and switches, it is highly advised that you change your priority in a robust and reliable switch in your internetwork as opposed to letting this election occur by chance. This is especially true because manufacturers choose the MAC address, and a lower MAC address could very well mean an old or low-end switch or bridge, which might not be the best choice for your root bridge. How to manually set the priority is discussed later in this chapter.

These Bridge IDs are advertised to each other through Bridge Protocol Data Units (BPDUs). These messages are sent as multicasts every 2 seconds by the root bridge out its interfaces to other switches on adjoining segments who, in turn, forward them on to other connected switches. In addition, these messages also contain the Bridge ID of the root bridge in every update that is sent. As long as you are receiving BPDUs that contain a higher Bridge ID than your Bridge ID, you will remain the root bridge (because all devices assume they are the root at startup).

In addition to the local bridge ID and the root bridge ID, BPDUs contain information that helps switches perform calculations to decide which ports should be forwarding and which should be blocking to create a loop-free switched network. The key to this calculation lies within the cumulative cost back to the root bridge. Although it sounds as if these Cisco switches are keeping track of how much you paid for them, this is not what is meant when you use the term “cost.” The cost is actually an inverse of the bandwidth for each link segment. Because it is the inverse, the lower the cumulative cost back to the root bridge, the faster the path is. Table 13.1 lists the standard costs used today in switches. It is possible to change these values administratively if you want to control which link becomes the best path to the root bridge.

After the root bridge is determined, each nonroot switch or bridge forms an association back to the root bridge based on the lowest cumulative path cost back to the root. Whichever interface has the fastest route to the root bridge automatically becomes a forwarding port called the root port.

The root bridge advertises a root path cost of 0 to Switches B and D. As the BPDU enters their interfaces, they add the cost value of that interface and advertise that to any adjacent switches on other segments. Every nonroot bridge determines its fastest path back to the root by looking at these BPDUs that it receives from other switches. For instance, Switch B knows that going out of the top segment back to the root has a cost of 4, and going through Switch C has a cost of 42. Because the top segment has the lowest cumulative cost, that becomes the root port for Switch B.

What would happen if there were a tie in the root path cost? For instance, Switch C has two equal-cost paths of 23 back to the root bridge through Switch B and Switch D. In the event of a tie, the following are calculated to determine the root port:

Figure 13.5 expans on the switched networking example to include the path costs.

Figure 13.5. Root port calculation.

After every switch has determined its root port, the switches and bridges determine which port is to become the designated port for every segment that connects the two switches. As the name states, the designated port is the port on each interconnecting segment that is designated to forward traffic from that segment to another segment back to the root bridge. This too is determined through a calculation of the fastest way back to the root port. In the case of a tie, the same decision criteria applies to designated ports as root ports as described earlier.

In Figure 13.6, the designated ports have been calculated based on which switch is advertising the lowest cumulative cost back to the root on each segment. For instance, the BPDUs from Switch B to Switch C are advertising a root path cost of 19, whereas the BPDU being sent from Switch C to Switch B is advertising 38. Because Switch B has the lower root path cost, that is the designated port for that segment.

Figure 13.6. Designated port calculation.

To this point, the discussion has focused on how to determine which ports will be forwarding traffic in a switched network. Yet to be addressed is the original point of STP, which is to remove any potential switching loops. To remove potential switching loops, switches and bridges keep any port that is not a root or designated port in a blocked state. Keep in mind that a blocked state is not disabled (shut down); the interface is just not participating in forwarding any data. Blocked interfaces still received BPDUs from other switches to react to any changes in the topology.

In Figure 13.7, notice that all the root ports have been elected, as well as the designated ports for each segment. Notice on the segment between Switch C and Switch D that a port connected to Switch C is not a root port or a designated port. This port blocks user data to ensure that a switching loop does not occur and expose the network to broadcast storms. This also means that any devices connected to Switch C sending Ethernet data to any device connected to Switch D will ultimately go through Switch B, and then Switch A, to finally arrive at Switch D.

Figure 13.7. Blocked port calculation.

Challenge

To ensure your understanding of STP, this challenge steps you through the scenario illustrated in Figure 13.8. Figure 13.8. STP challenge scenario. All switches believe themselves to be the root bridge at startup. After sending their BPDUs, which switch remains the root bridge, and why? Every nonroot bridge determines its root ports. Which interfaces become root ports based on the election result? Every segment must have a designated port to use to forward traffic onto other segments. Which interfaces on the three segments will be designated ports? One port should remain that is not designated or a root port. In what state will this port be?

<division> <title>Challenge Answer</title>

Figure 13.9 displays the end result of the STP election and calculation. Switch C becomes the root bridge in this design because the default priority was administratively changed in this design to 4096, giving Switch C the lowest Bridge ID. Because Switch A and Switch B are nonroot bridges, they must calculate their root ports based on the lowest cumulative cost back to the root bridge. For each segment, the switch with the lowest root path cost will be the designated port. Because Switch C’s interface on the lower segment is not a root or designated port, that interface will be blocking.

Figure 13.9. STP challenge scenario answer.

</division>

Cisco Layer 2 switches forward frames solely based on MAC addresses. On the other hand, Layer 3 switches and routers use IP addresses in their data forwarding decisions. So why assign an IP address to a Layer 2 switch?

Chapter 8, “Foundation Cisco Configurations,” mentions that to remotely manage a device via SSH, Telnet, or HTTP, you need to have IP connectivity to the switch. Likewise, if you were to manage the switch using SNMP, you would also have to program your management server to use its IP address to gather statistics from the switch. All these management functions assume that an IP address is assigned to the device, which in the Catalyst switch’s case does not have an IP address in its default configuration.

Unlike Cisco routers, Layer 2 switches do not assign IP addresses on all the physical interfaces. In fact, the interface to which you assign an IP address on a Layer 2 Catalyst switch is actually a virtual interface called VLAN 1. To assign an IP address to the entire switch, you use exactly the same syntax as a router’s physical interface to configure the VLAN 1 interface:

Switch(config)#interface VLAN1
Switch(config-if)#ip address 172.16.1.100 255.255.0.0
Switch(config-if)#no shutdown
01:35:19: %LINK-3-UPDOWN: Interface Vlan1, changed state to up

If you were to Telnet into the switch from the terminal on the far network, the Telnet traffic would traverse through the local router, across the WAN link, through the remote router, and finally to the switch. To return the Telnet traffic back to the terminal, the switch would have to send it to a routing device, because the terminal is on another network. To instruct the switch to send any traffic destined for another network to that router, you have to define a default gateway (also known as a gateway of last resort) as shown in Figure 13.10.

Figure 13.10. Remote management requirement for default gateway.

The command to configure a default gateway is ip default-gateway, followed by the IP address of the router that is on the switch’s segment in Global Configuration. Using the example in Figure 13.10, the configuration would look like the following:

Switch(config)#ip default-gateway 172.16.1.1

Similar to router interfaces, the IP assigned to the VLAN 1 interface and the default gateway can be dynamically assigned using a DHCP server. The configuration is also similar to DHCP-assigned router interfaces except that the configuration is applied to the logical VLAN 1 interface as opposed to a physical port on the switch:

Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#interface vlan 1
Switch(config-if)#ip address dhcp
Switch(config-if)#no shutdown
00:58:49: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
Interface Vlan1 assigned DHCP address 172.16.1.100, mask 255.255.0.0

After the ip address dhcp command is applied, the switch sends a DHCPDISCOVER broadcast out on all switch ports assigned to VLAN1 (by default, all switch ports are assigned to VLAN1). If a configured DHCP server exists on those segments, it replies with the IP address for the VLAN 1 interface and default gateway for the switch. As such, there is no required configuration of an IP address or default gateway in the switch configuration. It must be said, however, that despite the fact that this does simplify some of the administration configuration or reconfiguration tasks that are necessary to manage a switch, it is not practical because you need to readily know the IP address of the switch to effectively manage it.

Verifying the IP address and default gateway assigned by the DHCP server cannot be achieved by showing the running or startup configuration. Instead, you can use output from the show dhcp lease command to verify the IP address and default gateway:

Switch#show dhcp lease
Temp IP addr: 172.16.1.100 for peer on Interface: Vlan1
Temp  sub net mask: 255.255.0.0
   DHCP Lease server: 172.16.1.1, state: 3 Bound
   DHCP transaction id: 1967
   Lease: 16000 secs,  Renewal: 3000 secs,  Rebind: 16000 secs
Temp default-gateway addr: 172.16.1.1
   Next timer fires after: 00:00:32
   Retry count: 0   Client-ID: cisco-0019.e86a.6fc0-Vl1
   Hostname: Switch

By design, switches may have a plethora of interfaces that may require a similar configuration. For instance, if the first 20 ports of your switch need to be set to a speed of 100mbs and full duplex, you would be undertaking quite an administrative task of typing the same commands into each interface configuration for all 20 interfaces. To save time, the Catalyst switch’s IOS contains a navigation and configuration command shortcut called interface range that enables you to define a range of switch ports and configure them simultaneously. The configuration can be condensed to something like this:

Switch(config)#interface range FastEthernet 0/1 - 20
Switch(config-if)#speed 100
Switch(config-if)#duplex full

Objective:

STP is enabled by default on all Cisco Catalyst switches. To verify spanning tree operation in your switch, you can issue the show spanning-tree command to see a display of the STP operations:

Switch>show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     000c.65d0.4e00
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     000d.65d0.4e00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15
Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- ----------------------------
Fa0/1            Desg LIS 19        128.1    P2p
Fa0/23           Desg FWD 19        128.23   P2p
Fa0/24           Back BLK 19        128.24   P2p

Notice in this output that you can see the MAC address and the priority of the root bridge and the local switch (which happens to be the root bridge). In addition, you can see the timers used in 802.1d for port state transitions, including the max age and forward delay. Finally, this useful show command displays the interfaces that are active and participating in STP and their associated role and state in the spanning tree network.