Cisco Configuration Professional (CCP) for my 871w router

CCP is the "new" GUI from Cisco that is used to manage their routers. It's a free downloadable software (using a CCO account) and it has also replaced Security Device Manager (SDM) a couple of years ago.

Here are the quick steps and commands used to enable my 871w router for CCP.

871W#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
871W(config)#username admin privilege 15 password cisco123   // CCP DOESN'T LIKE cisco/cisco AND IT WILL ASK YOU TO CREATE A MORE SECURE USER ACCOUNT
871W(config)#ip http server    // USE ip http secure-server FOR HTTPS ACCESS
871W(config)#ip http authentication local


You'll need to install an older version of Java for CCP to work nicely.  The file version used on my Windows 7 PC is running 6.0.310.79.

If you just double-click the program, it will open the CCP window and display "Retrieving port" indefinitely. The program must be "Run as administrator" which can be done by doing a right-click on the program.

After successfully opening CCP, it will ask you for the IP address, username and password of the discovered device.

CCP is smart enough to detect and ask you to change the default login of cisco/cisco.

The Configure section covers a lot of functions for managing the router. I just put here some screenshots, including Monitor section, which are of interest.

Configuring NetFlow

I started monitoring my Internet edge router using NetFlow (version 5). There is a new version called Flexible NetFlow (FNF), which is more scalable and have additional options available. This topic was included in the SECURE course. Maybe I would consider doing FNF for my next blog since the IOS can support it.

871W(config)#flow ?
  exporter  Define a Flow Exporter
  monitor   Define a Flow Monitor
  record    Define a Flow Record


I'm always curious what are the traffic my router sends and receives on the Internet. These are the current users in my home network.

871W#show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
192.168.1.21        0188.c663.b59e.29       Oct 12 2013 10:58 PM    Automatic
192.168.1.22        0178.ca39.e481.e3       Oct 12 2013 09:50 PM    Automatic
192.168.1.23        01d8.9e3f.87a7.c5       Oct 12 2013 09:50 PM    Automatic
192.168.1.24        0190.187c.69a7.d1       Oct 12 2013 09:50 PM    Automatic
192.168.1.25        01e0.f847.a03b.2f       Oct 12 2013 09:51 PM    Automatic
192.168.1.26        016c.71d9.079e.5d       Oct 12 2013 10:22 PM    Automatic
192.168.1.27        01ec.55f9.01f9.0c       Oct 12 2013 10:36 PM    Automatic   // THIS IS ME


There are many NetFlow analyzers out there, but for this scenario I used a free tool from Solarwinds called the Real-time NetFlow Traffic Analyzer (NTA). This is what the application looks like and the commands used to enable NetFlow:

871W(config)#ip flow?
flow-aggregation  flow-cache        flow-capture  flow-egress
flow-export       flow-top-talkers

871W(config)#ip flow-export ?
  destination      Specify the Destination IP address
  interface-names  Export interface names
  source           Specify the interface for source address
  template         Specify the template specific configurations
  version          Specify the version number

871W(config)#ip flow-export destination ?
  Hostname or A.B.C.D  Destination IP address

871W(config)#ip flow-export destination 192.168.1.27 ?
  <1-65535>  UDP/SCTP port number

871W(config)#ip flow-export destination 192.168.1.27 2055    // DEFAULT UDP PORT
871W(config)#ip flow-export version ?
  1
  5
  9

871W(config)#ip flow-export version 5
871W(config)#ip flow-export source ?
  Async               Async interface
  BVI                 Bridge-Group Virtual Interface
  CDMA-Ix             CDMA Ix interface
  CTunnel             CTunnel interface
  Dialer              Dialer interface
  Dot11Radio          Dot11 interface
  FastEthernet        FastEthernet IEEE 802.3
  Lex                 Lex interface
  Loopback            Loopback interface
  Multilink           Multilink-group interface
  Null                Null interface
  Tunnel              Tunnel interface
  Vif                 PGM Multicast Host interface
  Virtual-Dot11Radio  Virtual dot11 interface
  Virtual-PPP         Virtual PPP interface
  Virtual-Template    Virtual Template interface
  Virtual-TokenRing   Virtual TokenRing
  Vlan                Vlan IEEE 802.1q
  vmi                 Virtual Multipoint Interface

871W(config)#ip flow-export source bvi1
871W(config)#ip flow-cache ?
  entries  Specify the number of entries in the flow cache
  timeout  Specify flow cache timeout parameters

871W(config)#ip flow-cache timeout ?
  active    Specify the active flow timeout
  inactive  Specify the inactive flow timeout

871W(config)#ip flow-cache timeout active ?
  <1-60>  Timeout in minutes

871W(config)#ip flow-cache timeout active 5
871W(config)#interface bvi1     // LAN INTERFACE
871W(config-if)#ip route-cache flow
871W(config-if)#interface fastethernet4     // WAN INTERFACE
871W(config-if)#ip route-cache flow
871W(config-if)#exit

871W#show run | include flow
 ip route-cache flow
 ip route-cache flow
ip flow-cache timeout active 5
ip flow-export source BVI1
ip flow-export version 5
ip flow-export destination 192.168.1.27 2055

871W#show ip flow ?
  export       Display export statistics
  interface    Display flow configuration on Interfaces
  top-talkers  Display top talkers

871W#show ip flow export
Flow export v5 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Source(1)       192.168.1.1 (BVI1)
    Destination(1)  192.168.1.27 (2055)
  Version 5 flow records
  4185 flows exported in 179 udp datagrams
  0 flows failed due to lack of export packet
  143 export packets were sent up to process level
  0 export packets were dropped due to no fib
  16 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures

871W#show ip cache flow
IP packet size distribution (214853 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .061 .005 .002 .001 .001 .000 .000 .000 .000 .000 .000 .000 .000 .001

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .000 .005 .913 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes
  93 active, 4003 inactive, 4827 added
  70986 ager polls, 0 flow alloc failures
  Active flows timeout in 5 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 25800 bytes
  93 active, 931 inactive, 4430 added, 4430 added to flow
  0 alloc failures, 0 force free
  1 chunk, 1 chunk added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet           4      0.0        55    41      0.0      16.3      15.2
TCP-WWW           2802      0.5        72  1422     37.2       3.7       8.4
TCP-other         1043      0.1         9   643      1.8       2.2       9.2
UDP-DNS            161      0.0         1    65      0.0       0.0      15.4
UDP-NTP             20      0.0         1    76      0.0       0.0      15.1
UDP-other          695      0.1         1   136      0.1       0.1      15.4
ICMP                 9      0.0         1    58      0.0       4.2      15.4
Total:            4734      0.8        45  1379     39.2       2.7       9.9

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
BV1           192.168.1.24    Fa4           63.168.61.65    06 C5F8 01BB     1
BV1           192.168.1.24    Fa4           74.125.235.55   06 DCD9 01BB     4
BV1           192.168.1.27    Fa4           173.252.102.241 06 05F9 01BB     1
Fa4           74.125.235.50   BV1           59.189.105.75   06 01BB 8FB7     8
Fa4           173.194.38.156  BV1           59.189.105.75   06 0050 CEAD     1
BV1           192.168.1.24    Fa4           31.186.225.24   06 C2F2 0050     2
BV1           192.168.1.24    Fa4           31.186.225.24   06 C2F1 0050     2
BV1           192.168.1.24    Fa4           31.186.225.24   06 C2F9 0050     2
BV1           192.168.1.24    Fa4           173.245.2.213   06 BD3C 0050     1
BV1           192.168.1.24    Fa4           54.230.150.226  06 885E 0050     1
Fa4           74.125.235.55   BV1           59.189.105.75   06 01BB DCD9     2
Fa4           91.190.216.61   BV1           59.189.105.75   06 303E D367     1
BV1           192.168.1.24    Fa4           96.7.54.91      06 9F19 0050     1
BV1           192.168.1.24    Fa4           96.7.54.91      06 9F16 0050     1
BV1           192.168.1.24    Fa4           74.125.235.50   06 8FB7 01BB     5
Fa4           72.246.189.33   BV1           59.189.105.75   06 0050 DE4D     1
BV1           192.168.1.27    Fa4           172.16.1.254    06 0ED8 0050     2
Fa4           173.245.2.213   BV1           59.189.105.75   06 0050 BD3C     1
BV1           192.168.1.24    Fa4           199.38.166.155  06 8981 0050     1
Fa4           72.246.188.97   BV1           59.189.105.75   06 0050 D1ED     1
BV1           192.168.1.24    Fa4           184.73.189.70   06 DEBE 0050     1
BV1           192.168.1.24    Fa4           54.241.220.8    06 A300 0050     2
BV1           192.168.1.24    Fa4           72.246.188.89   06 8ACC 0050     1
BV1           192.168.1.24    Fa4           195.8.215.136   06 8D6B 0050     3
BV1           192.168.1.24    Fa4           195.8.215.136   06 8D6C 0050     2
BV1           192.168.1.25    Fa4           91.190.216.61   06 D367 303E     2

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
BV1           192.168.1.24    Fa4           173.194.38.143  06 A7D7 0050     1
BV1           192.168.1.24    Fa4           173.194.38.143  06 A7D6 0050     1
BV1           192.168.1.27    Local         192.168.1.1     06 0444 0017    37
BV1           192.168.1.24    Fa4           199.38.166.156  06 DF2A 0050     1
BV1           192.168.1.25    Null          8.8.8.8         11 E1E8 0035     1
Fa4           199.38.166.156  BV1           59.189.105.75   06 0050 DF2A     1
BV1           192.168.1.24    Fa4           72.246.188.98   06 CB3A 0050     1
BV1           192.168.1.24    Fa4           72.246.188.211  06 B83E 0050     1
Fa4           173.194.38.141  BV1           59.189.105.75   06 0050 A995     1
BV1           192.168.1.24    Fa4           8.39.37.21      06 A258 0050     2
BV1           192.168.1.24    Fa4           8.39.37.21      06 A272 0050     2
BV1           192.168.1.24    Fa4           8.39.37.21      06 A273 0050     2
BV1           192.168.1.24    Fa4           8.39.37.21      06 A271 0050     2
BV1           192.168.1.24    Fa4           8.39.37.21      06 A274 0050     2
Fa4           173.194.38.143  BV1           59.189.105.75   06 0050 A7D7     1
Fa4           173.194.38.143  BV1           59.189.105.75   06 0050 A7D6     1
Fa4           72.246.188.89   BV1           59.189.105.75   06 0050 8ACC     1
BV1           192.168.1.24    Fa4           192.33.31.101   06 8B5B 01BB     2
Fa4           8.8.8.8         Local         59.189.105.75   11 0035 EF47     1
Fa4           173.252.102.241 BV1           59.189.105.75   06 01BB 05F9     2
Fa4           195.8.215.136   BV1           59.189.105.75   06 0050 8D6A     3
Fa4           195.8.215.136   BV1           59.189.105.75   06 0050 8D6B     2
Fa4           195.8.215.136   BV1           59.189.105.75   06 0050 8D6C     1
Fa4           204.11.109.160  BV1           59.189.105.75   06 0050 C659     1
Fa4           72.246.188.98   BV1           59.189.105.75   06 0050 CB3A     1
BV1           192.168.1.24    Fa4           74.125.139.120  06 8435 0050     1
Fa4           54.241.220.8    BV1           59.189.105.75   06 0050 A300     1
BV1           192.168.1.24    Fa4           50.97.214.162   06 B716 0050     1
Fa4           184.73.189.70   BV1           59.189.105.75   06 0050 DEBE     1
Fa4           72.246.188.211  BV1           59.189.105.75   06 0050 B83E     1
Fa4           31.186.225.24   BV1           59.189.105.75   06 0050 C2F9     1
Fa4           31.186.225.24   BV1           59.189.105.75   06 0050 C2F1     1
Fa4           31.186.225.24   BV1           59.189.105.75   06 0050 C2F2     1
Fa4           204.11.109.63   BV1           59.189.105.75   06 0050 A5DA     1
Fa4           72.5.64.63      BV1           59.189.105.75   06 0050 94BF     1
BV1           192.168.1.24    Fa4           173.194.38.141  06 A995 0050     1
BV1           192.168.1.25    Fa4           23.58.242.217   06 D374 01BB     7
BV1           192.168.1.24    Fa4           72.246.189.25   06 86FE 0050     1
Fa4           74.125.139.120  BV1           59.189.105.75   06 0050 8435     1
BV1           192.168.1.24    Fa4           31.13.68.8      06 DB30 0050     3
BV1           192.168.1.25    Null          8.8.8.8         11 EF47 0035     1
Fa4           63.168.61.65    BV1           59.189.105.75   06 01BB C5F8     1
Fa4           72.246.189.25   BV1           59.189.105.75   06 0050 86FE     1
BV1           192.168.1.24    Fa4           66.117.25.36    06 A0B6 0050     2
BV1           192.168.1.24    Fa4           38.108.107.27   06 CD4A 0050     3
BV1           192.168.1.24    Fa4           38.108.107.27   06 CD49 0050     3
BV1           192.168.1.24    Fa4           31.13.68.16     06 CC94 0050     1
BV1           192.168.1.24    Fa4           31.13.68.16     06 CC91 0050     1
BV1           192.168.1.24    Fa4           31.13.68.16     06 CC8C 0050     1
Fa4           10.143.96.1     Null          255.255.255.255 11 0043 0044     2
BV1           192.168.1.24    Fa4           31.13.68.16     06 CC8A 0050     1
BV1           192.168.1.24    Fa4           31.13.68.16     06 CC85 0050     1
BV1           192.168.1.24    Fa4           31.13.68.16     06 CC87 0050     1
Fa4           23.58.225.224   BV1           59.189.105.75   06 0050 ED24     1
Fa4           31.13.68.8      BV1           59.189.105.75   06 0050 DB30     3

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
BV1           192.168.1.24    Fa4           204.236.131.45  06 9F55 0050     3
BV1           192.168.1.24    Fa4           204.11.109.63   06 A5DA 0050     1
BV1           192.168.1.27    Local         192.168.1.1     11 EB78 00A1   165
Fa4           96.7.54.91      BV1           59.189.105.75   06 0050 9F16     1
Fa4           96.7.54.91      BV1           59.189.105.75   06 0050 9F19     1
BV1           192.168.1.24    Fa4           173.194.38.156  06 CEAD 0050     1
BV1           192.168.1.24    Fa4           96.7.54.88      06 9005 0050     3
BV1           192.168.1.24    Fa4           96.7.54.88      06 9004 0050     3
BV1           192.168.1.24    Fa4           204.11.109.160  06 C659 0050     1
Fa4           23.58.242.217   BV1           59.189.105.75   06 01BB D374     7
Fa4           38.108.107.27   BV1           59.189.105.75   06 0050 CD49     3
Fa4           38.108.107.27   BV1           59.189.105.75   06 0050 CD4A     3
BV1           192.168.1.24    Fa4           72.5.64.63      06 94BF 0050     1
BV1           192.168.1.24    Fa4           72.246.188.97   06 D1ED 0050     1
Fa4           72.246.188.216  BV1           59.189.105.75   06 0050 DDB9     1
Fa4           72.246.188.216  BV1           59.189.105.75   06 0050 DDD3     1
Fa4           72.246.188.216  BV1           59.189.105.75   06 0050 DDD2     1
Fa4           204.236.131.45  BV1           59.189.105.75   06 0050 9F55     1

871W#show ip flow top-talkers
% Top talkers not configured
871W#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
871W(config)#ip flow?
flow-aggregation  flow-cache        flow-capture  flow-egress
flow-export       flow-top-talkers

871W(config)#ip flow-top-talkers   
871W(config-flow-top-talkers)#?
Netflow top talker configuration commands:
  cache-timeout  Configure cache timeout
  default        Set a command to its defaults
  exit           Exit from top talkers configuration mode
  match          Configure match criteria
  no             Negate a command or set its defaults
  sort-by        Configure top talker sort criteria
  top            Configure number of top talkers

871W(config-flow-top-talkers)#top ?
  <1-200>  Number of top talkers

871W(config-flow-top-talkers)#top 10
871W(config-flow-top-talkers)#sort-by ?
  bytes    Sort top talkers by bytes
  packets  Sort top talkers by packets

871W(config-flow-top-talkers)#sort-by bytes
871W(config-flow-top-talkers)#end

871W#show ip flow top-talkers

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes
Fa4           165.254.58.10   BV1           59.189.105.75   06 01BB A28D   134K
Fa4           23.61.194.64    BV1           59.189.105.75   06 01BB 8958   120K
Fa4           165.254.58.25   BV1           59.189.105.75   06 01BB E472   120K
Fa4           72.246.188.251  BV1           59.189.105.75   06 01BB DDA7   106K
Fa4           23.59.188.139   BV1           59.189.105.75   06 01BB BCDA    53K
Fa4           23.59.189.147   BV1           59.189.105.75   06 01BB CFEF    48K
BV1           192.168.1.27    Local         192.168.1.1     11 EB78 00A1    21K
Fa4           63.168.61.65    BV1           59.189.105.75   06 01BB D5F4    16K
BV1           192.168.1.25    Fa4           64.4.23.145     06 D388 9C62    12K
Fa4           17.173.66.179   BV1           59.189.105.75   06 01BB D38A    11K
10 of 10 top talkers shown. 71 flows processed.


The source port (SrcP) and destination port (DstP) on the top talker's list are displayed in hexadecimal values. We just convert it to decimal using this cool web tool:

It's good to know that most websites nowadays are doing encryption (HTTPS/TCP port 443). Looks like Facebook and Google are on the top visited domains. There's also a Braille protocol listed and someone must've tried to perform a denial of service (DOS) attack on my home network (holy crap!). It seems like there's a lot of crazy stuff going on over the Internet.

VLAN Trunking Protocol (VTP) Lab

After successfully setting up spanning tree from my previous blog, it's now time for some Layer 2 VLAN action. Refer to the updated network diagram used for this scenario.

A switch operates in VTP server mode by default. We configure SW2 in client mode with a VTP domain name of LAGURA (case sensitive), and a password of cisco. We verify using the show vtp status command. Notice that we can't add any VLANs under this mode.

The maximum number of  supported VLANs also depends on the switch platform. A Cisco Catalyst 2940 switch (SW2) supports up to 128 VLANs, a 3560 (SW1) supports up to1005 and a 2960 (SW3) supports up to 255. All of my switch are 8-port device.

SW2#show vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 128
Number of existing VLANs        : 5
VTP Operating Mode              : Server
VTP Domain Name                 :
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
Local updater ID is 0.0.0.0 (no valid interface found)
SW2#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW2(config)#vtp domain LAGURA
Changing VTP domain name from NULL to LAGURA
SW2(config)#vtp mode client
Setting device to VTP CLIENT mode.
SW2(config)#vtp password cisco
Setting device VLAN database password to cisco
SW2(config)#vlan 10
VTP VLAN configuration not allowed when device is in CLIENT mode.



SW1 and SW3 automatically update its VTP domain name to LAGURA after receiving a VTP advertisement from SW2. We then configure SW3 to operate in VTP transparent mode. Under this mode, the switch doesn't advertise its VLAN and have local significance only. We verify this by issuing a show vlan on adjacent switches.

SW1#show vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 5
VTP Operating Mode              : Server
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
Local updater ID is 0.0.0.0 (no valid interface found)


SW3#show vtp status
VTP Version                     : running VTP1 (VTP2 capable)   // DEFAULT VERSION
Configuration Revision          : 0
Maximum VLANs supported locally : 255
Number of existing VLANs        : 5
VTP Operating Mode              : Server
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
*** MD5 digest checksum mismatch on trunk: Fa0/2 ***
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
Local updater ID is 0.0.0.0 (no valid interface found)

SW3#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW3(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
SW3(config)#do show vtp status
VTP Version                     : running VTP1 (VTP2 capable)
Configuration Revision          : 0
Maximum VLANs supported locally : 255
Number of existing VLANs        : 5
VTP Operating Mode              : Transparent
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
*** MD5 digest checksum mismatch on trunk: Fa0/2 ***
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
SW3(config)#vlan 99
SW3(config-vlan)#name MARKETING
SW3(config-vlan)#end
*Mar  1 00:19:49.370: %SYS-5-CONFIG_I: Configured from console by consolean
SW3#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Gi0/1
99   MARKETING                        active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
99   enet  100099     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------


SW1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Gi0/1
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------


We can now start adding VLANs on the VTP server. After creating two VLANs, the configuration revision number incremented by 2 and number of existing VLANs increased to 7. Also notice that VLANs didn't replicate to SW3 since it is in transparent mode.

SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#vlan 10
SW1(config-vlan)#name SALES
SW1(config-vlan)#vlan 20
SW1(config-vlan)#name IT
SW1(config-vlan)#end
00:21:18: %SYS-5-CONFIG_I: Configured from console by console         
SW1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Gi0/1
10   SALES                            active
20   IT                               active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
10   enet  100010     1500  -      -      -        -    -        0      0
20   enet  100020     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

SW1#show vtp status
VTP Version                     : 2
Configuration Revision          : 2
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 7
VTP Operating Mode              : Server
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x17 0xC7 0x66 0x72 0xBE 0xF9 0x85 0x5E
Configuration last modified by 0.0.0.0 at 3-1-93 00:21:18
Local updater ID is 0.0.0.0 (no valid interface found)


SW3#show vtp status
VTP Version                     : running VTP1 (VTP2 capable)
Configuration Revision          : 0
Maximum VLANs supported locally : 255
Number of existing VLANs        : 6    // INCREMENTED BY 1 AFTER CREATING VLAN 99
VTP Operating Mode              : Transparent
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xB4 0xF5 0xE2 0x6E 0xC4 0x17 0x0A 0x8A
*** MD5 digest checksum mismatch on trunk: Fa0/2 ***
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
 SW3#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Gi0/1
99   MARKETING                        active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
99   enet  100099     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------


I've observed the VLANs didn't replicate to SW2, so I went troubleshooting.

SW2#show vtp password
VTP Password: cisco

SW2#show vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 128
Number of existing VLANs        : 5
VTP Operating Mode              : Client
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x43 0x8E 0xC5 0xB3 0x8F 0xC3 0x52 0x93
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
SW2#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Gi0/1
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

SW2#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
SW1              Fas 0/1            166          S I      WS-C3560-8Fas 0/1
SW3              Fas 0/2            135          S I      WS-C2960PDFas 0/2


I checked again and was confident that my VTP configurations for SW2 were correct. I also thought the VLAN database was corrupted. And sure enough the VLANs showed up afterwards (it took a while though). I've learned from a fellow blogger on his post that VTP indeed takes some time for VLANs to replicate. There's also a cool debug tip demonstrated.

I've also asked a Cisco Switching expert and told me that:

"By default, Catalyst switches issue summary advertisements in five-minute increments. Summary advertisements inform adjacent Catalysts of the current VTP domain name and the configuration revision number.

When the switch receives a summary advertisement packet, the switch compares the VTP domain name to its own VTP domain name. If the name is different, the switch simply ignores the packet. If the name is the same, the switch then compares the configuration revision to its own revision. If its own configuration revision is higher or equal, the packet is ignored. If it is lower, an advertisement request is sent. If you add a new switch in the network it takes 5 minutes so that it hears any advertisement from the server.

If you want the VLAN propagated immediately (means before the advertisements are generated and send again) then you need to create a vlan so that the revision number will change and the new switch will be updated, once the control checkpoints I just described passed."

SW2#show flash

Directory of flash:/

    2  -rwx         738  Mar 01 1993 01:16:13 +00:00  config.text
    4  drwx         192  Mar 01 1993 00:06:13 +00:00  c2940-i6k2l2q4-mz.121-22.EA10a
    3  -rwx         736  Mar 01 1993 01:16:06 +00:00  vlan.dat   // THIS IS WHERE VTP AND THE VLAN DATABASE IS STORED
  404  -rwx          24  Mar 01 1993 01:16:13 +00:00  private-config.text

7612416 bytes total (2191360 bytes free)

SW2#show vtp status
VTP Version                     : 2
Configuration Revision          : 2
Maximum VLANs supported locally : 128
Number of existing VLANs        : 7
VTP Operating Mode              : Client
VTP Domain Name                 : LAGURA
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x0B 0x33 0x0F 0x2D 0x8A 0xC3 0x8E 0x5E
Configuration last modified by 0.0.0.0 at 3-1-93 00:21:18

SW2#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Gi0/1
10   SALES                            active
20   IT                               active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
10   enet  100010     1500  -      -      -        -    -        0      0
20   enet  100020     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    srb      0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

Spanning Tree Protocol (STP) Lab

At last, I got my 8-port Catalyst 2940 switch. This would be the final piece to complete my switching lab. This is the baby brother of the Catalyst 2950, which is the most deployed and practical switch in both production and lab environments. I just can't help not buying this cute and awesome device.

 

 

Since I've gathered all my switches, I'm now able to create Spanning-Tree Protocol (STP) and VLAN Trunking Protocol (VTP) lab using the famous "switch triangle" topology. This topology makes more meaningful and challenging STP and VTP lab as compared to a single or switch pair topology.

We start by configuring the EtherChannel and trunk links on the C3560 first, on the C2960 and finally on the C2940.

Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname SW1
SW1(config)#do show interface status

Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        notconnect   1            auto   auto 10/100BaseTX
Fa0/2                        notconnect   1            auto   auto 10/100BaseTX
Fa0/3                        notconnect   1            auto   auto 10/100BaseTX
Fa0/4                        notconnect   1            auto   auto 10/100BaseTX
Fa0/5                        notconnect   1            auto   auto 10/100BaseTX
Fa0/6                        notconnect   1            auto   auto 10/100BaseTX
Fa0/7                        notconnect   1            auto   auto 10/100BaseTX
Fa0/8                        notconnect   1            auto   auto 10/100BaseTX
Gi0/1                        notconnect   1            auto   auto Not Present
SW1(config)#interface range fastethernet0/1-2
SW1(config-if-range)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.
// THIS ERROR HAPPENS TO APPEAR IN 3560
SW1(config-if-range)#switchport trunk encapsulation ?
  dot1q      Interface uses only 802.1q trunking encapsulation when trunking
  isl        Interface uses only ISL trunking encapsulation when trunking
  negotiate  Device will negotiate trunking encapsulation with peer on
             interface
SW1(config-if-range)#switchport trunk encapsulation dot1q
SW1(config-if-range)#switchport mode trunk
SW1(config-if-range)#end

----

Switch#configure terminal
*Mar  1 00:02:43.854: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively down
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname SW3
SW3(config)#do show interface status

Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        notconnect   1            auto   auto 10/100BaseTX
Fa0/2                        notconnect   1            auto   auto 10/100BaseTX
Fa0/3                        notconnect   1            auto   auto 10/100BaseTX
Fa0/4                        notconnect   1            auto   auto 10/100BaseTX
Fa0/5                        notconnect   1            auto   auto 10/100BaseTX
Fa0/6                        notconnect   1            auto   auto 10/100BaseTX
Fa0/7                        notconnect   1            auto   auto 10/100BaseTX
Fa0/8                        notconnect   1            auto   auto 10/100BaseTX
Gi0/1                        notconnect   1            auto   auto 10/100/1000BaseTX
SW3(config)#interface range fastethernet0/1-2
SW3(config-if-range)#switchport mode trunk
SW3(config-if-range)#end

----

Switch#configure terminal
00:02:36: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively down
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname SW2
SW2(config)#do sh int status

Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        notconnect   1            auto   auto 10/100BaseTX
Fa0/2                        notconnect   1            auto   auto 10/100BaseTX
Fa0/3                        notconnect   1            auto   auto 10/100BaseTX
Fa0/4                        notconnect   1            auto   auto 10/100BaseTX
Fa0/5                        notconnect   1            auto   auto 10/100BaseTX
Fa0/6                        notconnect   1            auto   auto 10/100BaseTX
Fa0/7                        notconnect   1            auto   auto 10/100BaseTX
Fa0/8                        notconnect   1            auto   auto 10/100BaseTX
Gi0/1                        notconnect   1            auto   auto 10/100/1000BaseTX
SW2(config)#interface range fastethernet0/1-2
                                           ^
% Invalid input detected at '^' marker.    // 2940 NEEDS A SPACE ON INTERFACE RANGE COMMAND

SW2(config)#interface range fastethernet0/1 - 2
SW2(config-if-range)#switchport mode trunk
SW2(config-if-range)#end


STP is enabled by default on switches (for VLAN 1) and we can quickly verify its operation by using the show spanning-tree command. From here we could see the Bridge ID (priority and MAC address) and the elected root bridge. All switches have a default priority of 32768 and the lower value has the highest priority (which in this case a value of 1).

If all switches have the same priority and extended system ID, the one with the lowest MAC address will be considered the root bridge. Notice that SW1's F0/2 port state is blocked (BLK) since it has the highest MAC address. It also considered this port to be redundant towards the root bridge.

SW2 (C2940) became the root bridge since it has the lowest MAC address compared to the other switches. Also noticed all of its ports are in the forwarding (FWD) state, which is the reward for a root bridge.

SW1#show spanning-tree ?
  active             Report on active interfaces only
  backbonefast       Show spanning tree backbonefast status
  blockedports       Show blocked ports
  bridge             Status and configuration of this bridge
  detail             Detailed information
  inconsistentports  Show inconsistent ports
  interface          Spanning Tree interface status and configuration
  mst                Multiple spanning trees
  pathcost           Show Spanning pathcost options
  root               Status and configuration of the root bridge
  summary            Summary of port states
  uplinkfast         Show spanning tree uplinkfast status
  vlan               VLAN Switch Spanning Trees
  |                  Output modifiers
  <cr>

SW1#show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     001b.0db0.8f00   // MAC ADDRESS OF C2940
             Cost        19
             Port        2 (FastEthernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     6416.8dec.a700    // MAC ADDRESS OF C3560
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Root FWD 19        128.2    P2p
Fa0/2            Altn BLK 19        128.3    P2p


SW3#show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     001b.0db0.8f00
             Cost        19
             Port        2 (FastEthernet0/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     001f.9d88.b980   // MAC ADDRESS OF C2960
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/1               Desg FWD 19        128.1    P2p
Fa0/2               Root FWD 19        128.2    P2p


SW2#show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     001b.0db0.8f00   // MAC ADDRESS OF C2940
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     001b.0db0.8f00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Fa0/2            Desg FWD 19        128.2    P2p

Since the C2940 has the lowest switching capacity, we could force the C3560 to be the primary root bridge and the C2960 as the secondary root bridge. We do this by issuing the commands spanning-tree vlan 1 root primary and spanning-tree vlan 1 root secondary in global config mode. Notice the priority for primary root and secondary root bridge became 24577 and 28673 respectively (multiples of 4096) and the C2940 F0/2 port went to a blocking state.

SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#spanning-tree ?
  backbonefast  Enable BackboneFast Feature
  etherchannel  Spanning tree etherchannel specific configuration
  extend        Spanning Tree 802.1t extensions
  logging       Enable Spanning tree logging
  loopguard     Spanning tree loopguard options
  mode          Spanning tree operating mode
  mst           Multiple spanning tree configuration
  pathcost      Spanning tree pathcost options
  portfast      Spanning tree portfast options
  transmit      STP transmit parameters
  uplinkfast    Enable UplinkFast Feature
  vlan          VLAN Switch Spanning Tree

SW1(config)#spanning-tree vlan ?
  WORD  vlan range, example: 1,3-5,7,9-11

SW1(config)#spanning-tree vlan 1 ?
  forward-time  Set the forward delay for the spanning tree
  hello-time    Set the hello interval for the spanning tree
  max-age       Set the max age interval for the spanning tree
  priority      Set the bridge priority for the spanning tree
  root          Configure switch as root
  <cr>

SW1(config)#spanning-tree vlan 1 root ?
  primary    Configure this switch as primary root for this spanning tree
  secondary  Configure switch as secondary root

SW1(config)#spanning-tree vlan 1 root primary
SW1(config)#end
00:14:19: %SYS-5-CONFIG_I: Configured from console by console
SW1#show spaning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    24577
             Address     6416.8dec.a700
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    24577  (priority 24576 sys-id-ext 1)
             Address     6416.8dec.a700
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.2    P2p
Fa0/2            Desg FWD 19        128.3    P2p


SW3#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW3(config)#spanning-tree vlan 1 root ?
  primary    Configure this switch as primary root for this spanning tree
  secondary  Configure switch as secondary root

SW3(config)#spanning-tree vlan 1 root secondary
SW3(config)#end
SW3#show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    24577
             Address     6416.8dec.a700
             Cost        19
             Port        1 (FastEthernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    28673  (priority 28672 sys-id-ext 1)
             Address     001f.9d88.b980
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/1               Root FWD 19        128.1    P2p
Fa0/2               Desg FWD 19        128.2    P2p


SW2#show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    24577
             Address     6416.8dec.a700
             Cost        19
             Port        1 (FastEthernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     001b.0db0.8f00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Root FWD 19        128.1    P2p
Fa0/2            Altn BLK 19        128.2    P2p

Just for fun and be able observe an STP loop, I've disabled spanning-tree on all switches using the no spanning-tree vlan 1 command. It could be observed on the last few seconds of the video that the LED lights went fuzzy and CPU utilization shoots up in just a few seconds.

SW1#show processes cpu sorted
CPU utilization for five seconds: 41%/6%; one minute: 21%; five minutes: 8%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 161       12391     22199        558 30.03% 13.42%  3.35%   0 Spanning Tree
 155          85       131        648  0.31%  0.07%  0.01%   0 Exec
   2           0      1060          0  0.00%  0.00%  0.00%   0 Load Meter
   1           0         3          0  0.00%  0.00%  0.00%   0 Chunk Manager
   3           0        14          0  0.00%  0.00%  0.00%   0 SpanTree Helper