Chapter 1. Packet Forwarding

Search in book...
Toggle Font Controls
Create new playlist

Name your new playlist

Playlist description (optional)
Sign In

Email address

Password

Forgot Password?

or

Continue with Facebook

Continue with Google
Sign Up

Full Name

Email address

Confirm Email Address

Password

or

Continue with Facebook

Continue with Google

Chapter 1. Packet Forwarding

This chapter covers covers the following subjects:

Network Device Communication: This section explains how switches forward traffic from a Layer 2 perspective and routers forward traffic from a Layer 3 perspective.

Forwarding Architectures: This section examines the mechanisms used in routers and switches to forward network traffic.

This chapter provides a review of basic network fundamentals and then dives deeper into the technical concepts related to how network traffic is forwarded through a router or switch architecture.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess whether you should read the entire chapter. If you miss no more than one of these self-assessment questions, you might want to move ahead to the “Exam Preparation Tasks” section. Table 1-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so you can assess your knowledge of these specific areas. The answers to the “Do I Know This Already?” quiz appear in Appendix A, “Answers to the ‘Do I Know This Already?’ Quiz Questions.”

Table 1-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

Foundation Topics Section	Questions
Network Device Communication	1–4
Forwarding Architectures	5–7

1. Forwarding of network traffic from a Layer 2 perspective uses what information?

Source IP address
Destination IP address
Source MAC address
Destination MAC address
Data protocol

2. What type of network device helps reduce the size of a collision domain?

Hub
Switch
Load balancer
Router

3. Forwarding of network traffic from a Layer 3 perspective uses what information?

Source IP address
Destination IP address
Source MAC address
Destination MAC address
Data protocol

4. What type of network device helps reduce the size of a broadcast domain?

Hub
Switch
Load balancer
Router

5. The _________ can be directly correlated to the MAC address table.

Adjacency table
CAM
TCAM
Routing table

6. A ___________ forwarding architecture provides increased port density and forwarding scalability.

Centralized
Clustered
Software
Distributed

7. CEF is composed of which components? (Choose two.)

Routing Information Base
Forwarding Information Base
Label Information Base
Adjacency table
MAC address table

Answers to the “Do I Know This Already?” quiz:

1 D

2 B

3 B

4 D

5 B

6 D

7 B, D

Foundation Topics

Network Device Communication

The primary function of a network is to provide connectivity between devices. There used to be a variety of network protocols that were device specific or preferred; today, almost everything is based on Transmission Control Protocol/Internet Protocol (TCP/IP). It is important to note that TCP/IP is based on the conceptual Open Systems Interconnection (OSI) model that is composed of seven layers. Each layer describes a specific function, and a layer can be modified or changed without requiring changes to the layer above or below it. The OSI model, which provides a structured approach for compatibility between vendors, is illustrated in Figure 1-1.

An overview of OSI (Open Systems Interconnection) model by layer is illustrated. — **Figure 1-1** *OSI Model*

The Open systems interconnection (OSI) model includes seven layers, which are stacked from bottom to top. Layer 1 (Physical layer) is responsible for media type and connector. Layer 2 (Data link layer) is responsible for hardware addressing. Layer 3 (Network layer) facilitates logical addressing and routing of packets. Layer 4 (Transport layer) provides end-to-end communication between devices. Layer 5 (Session layer) helps in tracking of packets. Layer 6 (Presentation layer) is used for the formatting of data and encryption. Layer 7 (Application layer) serves as the interface for receiving and sending data. The first three layers are indicated as Media, and the last four layers are indicated as Host.

When you think about the flow of data, most network traffic involves communication of data between applications. The applications generate data at Layer 7, and the device/host sends data down the OSI model. As the data moves down the OSI model, it is encapsulated or modified as needed.

At Layer 3, the device/host decides whether the data needs to be sent to another application on the same device, and it would then start to move the data up the stack. Or, if the data needs to be sent to a different device, the device/host continues processing down the OSI model toward Layer 1. Layer 1 is responsible for transmitting the information on to the media (for example, cable, fiber, radio waves). On the receiving side, data starts at Layer 1, then moves to Layer 2, and so on, until it has moved completely up to Layer 7 and on to the receiving application.

This chapter reinforces concepts related to how a network device forwards traffic from either a Layer 2 or a Layer 3 perspective. The first Layer 2 network devices were bridges or switches, and Layer 3 devices were strictly routers. As technology advanced, the development of faster physical media required the ability to forward packets in hardware through ASICs. As ASIC functionality continued to develop, multilayer switches (MLSs) were invented to forward Layer 2 traffic in hardware as if they were switches; however, they can also perform other functions, such as routing packets, from a Layer 3 perspective.

Layer 2 Forwarding

The second layer of the OSI model, the data link layer, handles addressing beneath the IP protocol stack so that communication is directed between hosts. Network packets include Layer 2 addressing with unique source and destination addresses for segments. Ethernet commonly uses media access control (MAC) addresses, and other data link layer protocols such as Frame Relay use an entirely different method of Layer 2 addressing.

The focus of the Enterprise Core exam is on Ethernet and wireless technologies, both of which use MAC addresses for Layer 2 addressing. This book focuses on the MAC address for Layer 2 forwarding.

Note

A MAC address is a 48-bit address that is split across six octets and notated in hexadecimal. The first three octets are assigned to a device manufacturer, known as the organizationally unique identifier (OUI), and the manufacturer is responsible for ensuring that the last three octets are unique. A device listens for network traffic that contains its MAC address as the packet’s destination MAC address before moving the packet up the OSI stack to Layer 3 for processing.

Network broadcasts with MAC address FF:FF:FF:FF:FF:FF are the exception to the rule and will always be processed by all network devices on the same network segment. Broadcasts are not typically forwarded beyond a Layer 3 boundary.

Collision Domains

The Ethernet protocol first used technologies like Thinnet (10BASE-2) and Thicknet (10BASE-5), which connected all the network devices using the same cable and T connectors. This caused problems when two devices tried to talk at the same time because the transmit cable shared the same segment with other devices, and the communication become garbled if two devices talked at the same time. Ethernet devices use Carrier Sense Multiple Access/Collision Detect (CSMA/CD) to ensure that only one device talks at time in a collision domain. If a device detects that another device is transmitting data, it delays transmitting packets until the cable is quiet. This means devices can only transmit or receive data at one time (that is, operate at half-duplex).

As more devices are added to a cable, the less efficient the network becomes as devices wait until there is not any communication. All of the devices are in the same collision domain. Network hubs proliferate the problem because they add port density while repeating traffic, thereby increasing the size of the collision domain. Network hubs do not have any intelligence in them to direct network traffic; they simply repeat traffic out of every port.

Network switches enhance scalability and stability in a network through the creation of virtual channels. A switch maintains a table that associates a host’s Media Access Control (MAC) Ethernet addresses to the port that sourced the network traffic. Instead of flooding all traffic out of every switch port, a switch uses the local MAC address table to forward network traffic only to the destination switch port associated with where the destination MAC is attached. This drastically reduces the size of the collision domain between the devices and enables the devices to transmit and receive data at the same time (that is, operate at full duplex).

Figure 1-2 demonstrates the collision domains on a hub versus on a switch. Both of these topologies show the same three PCs, as well as the same cabling. On the left, the PCs are connected to a network hub. Communication between PC-A and PC-B is received by PC-C’s NIC, too, because all three devices are in the same collision domain. PC-C must process the frame—in the process consuming resources—and then it discards the packet after determining that the destination MAC address does not belong to it. In addition, PC-C has to wait until the PC-A/PC-B conversation finishes before it can transmit data. On the right, the PCs are connected to a network switch. Communication between PC-A and PC-B are split into two collision domains. The switch can connect the two collision domains by using information from the MAC address table.

An illustration depicts the comparison of collision domains on a hub and a switch. — **Figure 1-2** *Collision Domains on a Hub Versus a Switch*

A figure compares the collision domains on a hub and a switch. On the left, three PCs namely PC-A, PC-B, and PC-C are connected to a hub. All three devices are in the same collision domain, represented with a circle around the hub. On the right, the PCs are connected to a switch through three collision domains, which are indicated by three circles at each connection.

When a packet contains a destination MAC address that is not in the switch’s MAC address table, the switch forwards the packet out of every switch port. This is known as unknown unicast flooding because the destination MAC address is not known.

Broadcast traffic is network traffic intended for every host on the LAN and is forwarded out of every switch port interface. This is disruptive as it diminishes the efficiencies of a network switch compared to those of a hub because it causes communication between network devices to stop due to CSMA/CD. Network broadcasts do not cross Layer 3 boundaries (that is, from one subnet to another subnet). All devices that reside in the same Layer 2 segment are considered to be in the same broadcast domain.

Figure 1-3 displays SW1’s MAC address table, which correlates the local PCs to the appropriate switch port. In the scenario on the left, PC-A is transmitting unicast traffic to PC-B. SW1 does not transmit data out of the Gi0/2 or Gi0/3 interface (which could potentially disrupt any network transmissions between those PCs). In the scenario on the right, PC-A is transmitting broadcast network traffic out all active switch ports.

A figure illustrates the scenarios of Unicast and broadcast traffic patterns. — **Figure 1-3** *Unicast and Broadcast Traffic Patterns*

In the figure, four devices connected to a single switch is taken as an example. On the left, PC-A with the MAC address, 0C:15:C0:00:11:01 is connected to the switch SW1 through the interface Gi0/0. Likewise, PC-B, PC-C, and PC-D with the MAC addresses, 0C:15:C0:00:22:02, 0C:15:C0:00:33:03, and 0C:15:C0:04:44:04 are connected to the same switch via the interfaces Gi0/1, Gi0/2, and Gi0/3, respectively. The data flows from PC-A to PC-B via the switch SW1, which indicates the unicast traffic pattern. On the right, the connection of PCs to the switch through the interfaces are the same as of the set-up on the left. The data flows from the PC-A to the PC-B, PC-C, and PC-D via the switch SW1, which indicates the broadcast traffic pattern. The MAC address table of the switch SW1 lists the MAC addresses and the corresponding interfaces.

Note

The terms network device and host are considered interchangeable in this text.

Virtual LANs

Adding a router between LAN segments helps shrink broadcast domains and provides for optimal network communication. Host placement on a LAN segment varies because of network addressing. Poor host network assignment can lead to inefficient use of hardware as some switch ports could be unused.

Virtual LANs (VLANs) provide logical segmentation by creating multiple broadcast domains on the same network switch. VLANs provide higher utilization of switch ports because a port can be associated to the necessary broadcast domain, and multiple broadcast domains can reside on the same switch. Network devices in one VLAN cannot communicate with devices in a different VLAN via traditional Layer 2 or broadcast traffic.

VLANs are defined in the Institute of Electrical and Electronic Engineers (IEEE) 802.1Q standard, which states that 32 bits are added to the packet header in the following fields:

Tag protocol identifier (TPID): This 16-bit is field set to 0x8100 to identify the packet as an 802.1Q packet.
Priority code point (PCP): This 3-bit field indicates a class of service (CoS) as part of Layer 2 quality of service (QoS) between switches.
Drop elgible indicator (DEI): This 1-bit field indicates whether the packet can be dropped when there is bandwidth contention.
VLAN identifier (VLAN ID): This 12-bit field specifies the VLAN associated with a network packet.

Figure 1-4 displays the VLAN packet structure.

The fields in the VLAN packet structure are shown in a figure. — **Figure 1-4** *VLAN Packet Structure*

A figure shows the VLAN packet structure. The fields in the structure in order are as follows: Destination MAC; source MAC; TPID (0x8100) (16-bit); PCP (3-bit); DEI (1-bit); VLAN ID (12-bit); Destination IP; Source IP; Payload. TPID, PCP, D E I, and VLAN ID are the 802.1Q fields.

The VLAN identifier has only 12 bits, which provides 4094 unique VLANs. Catalyst switches use the following logic for VLAN identifiers:

VLAN 0 is reserved for 802.1P traffic and cannot be modified or deleted.
VLAN 1 is the default VLAN and cannot be modified or deleted.
VLANs 2 to 1001 are in the normal VLAN range and can be added, deleted, or modified as necessary.
VLANS 1002 to 1005 are reserved and cannot be deleted.
VLANs 1006 to 4094 are in the extended VLAN range and can be added, deleted, or modified as necessary.

VLANs are created by using the global configuration command vlan vlan-id. A friendly name (32 characters) is associated with a VLAN through the VLAN submode configuration command name vlanname. The VLAN is not created until the command-line interface (CLI) has been moved back to the global configuration context or a different VLAN identifier.

Example 1-1 demonstrates the creation of VLAN 10 (PCs), VLAN 20 (Phones), and VLAN 99 (Guest) on SW1.

Example 1-1 Creating a VLAN

Resource	Advanced	VLAN
Number of VLANs	4094	4094
Unicast MAC addresses	32,000	32,000
Overflow unicast MAC addresses	512	512
IGMP groups and multicast routes	4000	4000
Overflow IGMP groups and multicast routes	512	512
Directly connected routes	16,000	16,000
Indirectly connected IP hosts	7000	7000
Policy-based routing access control entries (ACEs)	1024	0
QoS classification ACEs	3000	3000
Security ACEs	3000	3000
NetFlow ACEs	1024	1024
Input Microflow policer ACEs	256,000	0
Output Microflow policer ACEs	256,000	0
FSPAN ACEs	256	256
Control Plane Entries	512	512

Key Topic Element	Description	Page
Paragraph	Collision domain	5
Paragraph	Virtual LANs (VLANs)	7
Section	Access ports	11
Section	Trunk ports	12
Paragraph	Content addressable memory	16
Paragraph	Address resolution protocol (ARP)	19
Paragraph	Packet Routing	20
Paragraph	IP address assignment	21
Section	Process switching	25
Section	Cisco Express Forwarding (CEF)	26
Section	Ternary content addressable memory	26
Section	Software CEF	28
Section	SDM templates	30

Task	Command Syntax
Define a VLAN	vlan vlan-id name vlanname
Configure an interface as a trunk port	switchport mode trunk
Configure an interface as an access port assigned to a specific VLAN	switchport mode access switchport access {vlan vlan-id \| name name}
Configure a static MAC address entry	mac address-table static mac-address vlan vlan-id interface interface-id
Clear MAC addresses from the MAC address table	clear mac address-table dynamic [{address mac-address \| interface interface-id \| vlan vlan-id}]
Assign an IPv4 address to an interface	ip address ip-address subnet-mask
Assign a secondary IPv4 address to an interface	ip address ip-address subnet-mask secondary
Assign an IPv6 address to an interface	ipv6 address ipv6-address/prefix-length
Modify the SDM database	sdm prefer {vlan \| advanced}
Display the interfaces that are configured as a trunk port and all the VLANs that they permit	show interfaces trunk
Display the list of VLANs and their associated ports	show vlan [{brief \| id vlan-id \| name vlanname \| summary}]
Display the MAC address table for a switch	show mac address-table [address mac-address \| dynamic \| vlan vlan-id]
Display the current interface state, including duplex, speed, and link state	show interfaces
Display the Layer 2 configuration information for a specific switchport	show interfaces interface-id switchport
Display the ARP table	show ip arp [mac-address \| ip-address \| vlan vlan-id \| interface-id].
Displays the IP interface table	show ip interface [brief \| interface-id \| vlan vlan-id]
Display the IPv6 interface table	show ipv6 interface [brief \| interface-id \| vlan vlan-id]

Table of Contents for Chapter 1. Packet Forwarding

Create new playlist

Sign In

Sign Up

Chapter 1. Packet Forwarding

“Do I Know This Already?” Quiz

Network Device Communication

Layer 2 Forwarding

Collision Domains

Virtual LANs

Access Ports

Trunk Ports

Native VLANs

Allowed VLANs

Layer 2 Diagnostic Commands

MAC Address Table

Switch Port Status

Interface Status

Layer 3 Forwarding

Local Network Forwarding

Packet Routing

IP Address Assignment

Routed Subinterfaces

Switched Virtual Interfaces

Routed Switch Ports

Verification of IP Addresses

Forwarding Architectures

Process Switching

Cisco Express Forwarding

Ternary Content Addressable Memory

Centralized Forwarding

Distributed Forwarding

Software CEF

Hardware CEF

Stateful Switchover

SDM Templates

Review All Key Topics

Complete Tables and Lists from Memory

Define Key Terms

Use the Command Reference to Check Your Memory

References in This Chapter

Table of Contents for
Chapter 1. Packet Forwarding