Configure AP Groups on WLC 2504

I've started a few blog posts regarding Cisco wireless and I recently implemented an AP Group on a WLC 2504. In the example below, there are currently two SSIDs: CREW-WIFI and eam. There was a client request to broadcast the SSID eam on APs 9 and 18 only. In order do that, I created a new AP Group by going to: WLAN > Advanced > AP Group. There's a default AP Group called default-group where all WLAN IDs (1 to 16) and all APs are currently mapped to.

I created a new AP Group called EAM-only and mapped the SSID eam under WLAN tab. We can manually choose certain APs to only broadcast the SSID eam and this is done under the APs tab. We tick APs 9 and 18 and click on Add APs. It takes some time for the APs to be part of a group.

Lastly, don't forget to save by clicking on Save Configuration.

Securing VLANs with Private VLANs, RACLS, and VACLs

I only knew and read about Private VLAN (PVLAN) in CCNP SWITCH and haven't implemented it in the real world not until it was decided not too long ago to use this feature in one of our clients. PVLAN is an elegant design wherein you save IP subnet assignment and isolate on Layer 2 at the same time.
 

ALS1#show vtp status
VTP Version                     : 2
Configuration Revision          : 3
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 7
VTP Operating Mode              : Client
VTP Domain Name                 : SWPOD
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Enabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x0A 0x4B 0x30 0x9A 0xFC 0x3F 0x22 0x8E
Configuration last modified by 172.16.1.3 at 3-1-93 00:35:06


DLS1#show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/13, Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
100  Staff                            active
200  Student                          active
1002 fddi-default                     act/unsup
1003 trcrf-default                    act/unsup
1004 fddinet-default                  act/unsup
1005 trbrf-default                    act/unsup


DLS1#show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Fa0/7       on               802.1q         trunking      1
Fa0/8       on               802.1q         trunking      1
Fa0/9       on               802.1q         trunking      1
Fa0/10      on               802.1q         trunking      1
Fa0/11      on               802.1q         trunking      1
Fa0/12      on               802.1q         trunking      1

Port        Vlans allowed on trunk
Fa0/7       1-4094
Fa0/8       1-4094
Fa0/9       1-4094
Fa0/10      1-4094
Fa0/11      1-4094
Fa0/12      1-4094

Port        Vlans allowed and active in management domain
Fa0/7       1,100,200
Fa0/8       1,100,200
Fa0/9       1,100,200
Fa0/10      1,100,200
Fa0/11      1,100,200

Port        Vlans allowed and active in management domain
Fa0/12      1,100,200

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/7       1,100,200
Fa0/8       1,100,200
Fa0/9       1,100,200
Fa0/10      1,100,200
Fa0/11      1,100,200
Fa0/12      1,100,200


DLS2#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   100  P Standby  172.16.1.3      local           172.16.1.1
Vl100       1   100  P Standby  172.16.100.3    local           172.16.100.1
Vl200       1   150  P Active   local           172.16.200.3    172.16.200.1


DLS1(config)#vlan 150
DLS1(config-vlan)#name Server-farm
DLS1(config-vlan)#exit
DLS1(config)#interface vlan 150
DLS1(config-if)#
*Mar  1 00:13:05.618: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan150, changed state to down
DLS1(config-if)#ip address 172.16.150.3 255.255.255.0
*Mar  1 00:13:32.839: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan150, changed state to up
DLS1(config-if)#standby 1 ip 172.16.150.1
DLS1(config-if)#standby 1 priority 100
DLS1(config-if)#standby 1 preempt
DLS1(config-if)#
*Mar  1 00:14:19.026: %HSRP-5-STATECHANGE: Vlan150 Grp 1 state Speak -> Standby
*Mar  1 00:14:19.530: %HSRP-5-STATECHANGE: Vlan150 Grp 1 state Standby -> Active


DLS2(config)#interface vlan 150
DLS2(config-if)#
*Mar  1 00:15:33.786: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan150, changed state to up
DLS2(config-if)#ip address 172.16.150.4 255.255.255.0
DLS2(config-if)#standby 1 ip 172.16.150.1
DLS2(config-if)#standby 1 priority 150
DLS2(config-if)#standby 1 preempt
DLS2(config-if)#
*Mar  1 00:16:18.908: %HSRP-5-STATECHANGE: Vlan150 Grp 1 state Listen -> Active
DLS2(config-if)#end
DLS2#
*Mar  1 00:16:39.343: %SYS-5-CONFIG_I: Configured from console by console
DLS2#show standby ?
  BVI              Bridge-Group Virtual Interface
  FastEthernet     FastEthernet IEEE 802.3
  GigabitEthernet  GigabitEthernet IEEE 802.3z
  Port-channel     Ethernet Channel of interfaces
  Vlan             Catalyst Vlans
  all              Include groups in disabled state
  brief            Brief output
  capability       HSRP capability
  delay            Group initialisation delay
  internal         Internal HSRP information
  redirect         HSRP ICMP redirect information
  |                Output modifiers
  <cr>

DLS2#show standby vlan ?
  <1-4094>  Vlan interface number

DLS2#show standby vlan 150 ?
  <0-255>  group number
  all      Include groups in disabled state
  brief    Brief output
  |        Output modifiers
  <cr>

DLS2#show standby vlan 150 brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl150       1   150  P Active   local           172.16.150.3    172.16.150.1


DLS1#show vtp status
VTP Version                     : running VTP2
Configuration Revision          : 4
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 8
VTP Operating Mode              : Server
VTP Domain Name                 : SWPOD
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Enabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x8D 0x7E 0xE7 0x9C 0x10 0xB8 0x90 0x47
Configuration last modified by 172.16.1.3 at 3-1-93 00:13:01
Local updater ID is 172.16.1.3 on interface Vl1 (lowest numbered VLAN interface found)


DLS2#show vtp status
VTP Version                     : running VTP2
Configuration Revision          : 4
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 8
VTP Operating Mode              : Server
VTP Domain Name                 : SWPOD
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Enabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x8D 0x7E 0xE7 0x9C 0x10 0xB8 0x90 0x47
Configuration last modified by 172.16.1.3 at 3-1-93 00:13:01
Local updater ID is 172.16.1.4 on interface Vl1 (lowest numbered VLAN interface found)


DLS1(config)#vlan 150
DLS2(config-vlan)#?
VLAN configuration commands:
  are           Maximum number of All Route Explorer hops for this VLAN (or
                zero if none specified)
  backupcrf     Backup CRF mode of the VLAN
  bridge        Bridging characteristics of the VLAN
  exit          Apply changes, bump revision number, and exit mode
  media         Media type of the VLAN
  mtu           VLAN Maximum Transmission Unit
  name          Ascii name of the VLAN
  no            Negate a command or set its defaults
  parent        ID number of the Parent VLAN of FDDI or Token Ring type VLANs
  private-vlan  Configure a private VLAN
  remote-span   Configure as Remote SPAN VLAN
  ring          Ring number of FDDI or Token Ring type VLANs
  said          IEEE 802.10 SAID
  shutdown      Shutdown VLAN switching
  state         Operational state of the VLAN
  ste           Maximum number of Spanning Tree Explorer hops for this VLAN (or
                zero if none specified)
  stp           Spanning tree characteristics of the VLAN
  tb-vlan1      ID number of the first translational VLAN for this VLAN (or
                zero if none)
  tb-vlan2      ID number of the second translational VLAN for this VLAN (or
                zero if none)

DLS1(config-vlan)#private-vlan ?
  association  Configure association between private VLANs
  community    Configure the VLAN as a community private VLAN
  isolated     Configure the VLAN as an isolated private VLAN
  primary      Configure the VLAN as a primary private VLAN

DLS1(config-vlan)#private-vlan primary
%Private VLANs can only be configured when VTP is in transparent mode.


DLS1(config)#vtp mode transparent      // NEED TO BE SET TO DEFINE PVLAN
Setting device to VTP TRANSPARENT mode.

DLS2(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.


DLS1(config)#vlan 151
DLS1(config-vlan)#?
VLAN configuration commands:
  are           Maximum number of All Route Explorer hops for this VLAN (or
                zero if none specified)
  backupcrf     Backup CRF mode of the VLAN
  bridge        Bridging characteristics of the VLAN
  exit          Apply changes, bump revision number, and exit mode
  media         Media type of the VLAN
  mtu           VLAN Maximum Transmission Unit
  name          Ascii name of the VLAN
  no            Negate a command or set its defaults
  parent        ID number of the Parent VLAN of FDDI or Token Ring type VLANs
  private-vlan  Configure a private VLAN
  remote-span   Configure as Remote SPAN VLAN
  ring          Ring number of FDDI or Token Ring type VLANs
  said          IEEE 802.10 SAID
  shutdown      Shutdown VLAN switching
  state         Operational state of the VLAN
  ste           Maximum number of Spanning Tree Explorer hops for this VLAN (or
                zero if none specified)
  stp           Spanning tree characteristics of the VLAN
  tb-vlan1      ID number of the first translational VLAN for this VLAN (or
                zero if none)
  tb-vlan2      ID number of the second translational VLAN for this VLAN (or
                zero if none)

DLS1(config-vlan)#private-vlan ?
  association  Configure association between private VLANs
  community    Configure the VLAN as a community private VLAN
  isolated     Configure the VLAN as an isolated private VLAN
  primary      Configure the VLAN as a primary private VLAN

DLS1(config-vlan)#private-vlan isolated    // DEFINE SECONDARY VLANS
DLS1(config-vlan)#exit
DLS1(config)#vlan 152
DLS1(config-vlan)#private-vlan community
DLS1(config-vlan)#exit
DLS1(config)#vlan 150
DLS1(config-vlan)#private-vlan primary
DLS1(config-vlan)#private-vlan association ?
  WORD    VLAN IDs of the private VLANs to be configured
  add     Add a VLAN to private VLAN list
  remove  Remove a VLAN from private VLAN list

DLS1(config-vlan)#private-vlan association 151,152     // CONFIGURE PRIMARY VLAN LAST AND ASSOCIATED SECONDARY VLANS


DLS2(config)#vlan 151
DLS2(config-vlan)#private-vlan isolated
DLS2(config-vlan)#exit
DLS2(config)#vlan 152
DLS2(config-vlan)#private-vlan community
DLS2(config-vlan)#exit
DLS2(config)#vlan 150
DLS2(config-vlan)#private-vlan primary
DLS2(config-vlan)#private-vlan association 151,152


DLS1(config)#interface vlan 150
DLS1(config-if)#private-vlan ?
  mapping  Set the private VLAN SVI interface mapping

DLS1(config-if)#private-vlan mapping ?
  WORD    Secondary VLAN IDs of the private VLAN SVI interface mapping
  add     Add a VLAN to private VLAN list
  remove  Remove a VLAN from private VLAN list

DLS1(config-if)#private-vlan mapping 151-152    // PERMITS PVLAN TRAFFIC TO BE SWITCHED THROUGH LAYER 3
DLS1(config-if)#
*Mar  1 00:25:38.403: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 151
*Mar  1 00:25:38.411: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 152


DLS2(config)#interface vlan 150
DLS2(config-if)#private-vlan mapping 151-152
DLS2(config-if)#
*Mar  1 00:27:00.561: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 151
*Mar  1 00:27:00.561: %PV-6-PV_MSG: Created a private vlan mapping, Primary 150, Secondary 152


DLS1#show vlan ?
  access-map    Vlan access-map
  brief         VTP all VLAN status in brief
  dot1q         Display dot1q parameters
  filter        VLAN filter information
  id            VTP VLAN status by VLAN id
  ifindex       SNMP ifIndex
  internal      VLAN internal usage
  mtu           VLAN MTU information
  name          VTP VLAN status by VLAN name
  private-vlan  Private VLAN information
  remote-span   Remote SPAN VLANs
  summary       VLAN summary information
  |             Output modifiers
  <cr>

DLS1#show vlan private-vlan

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
150     151       isolated
150     152       community


DLS2(config)#interface fastethernet0/6
DLS2(config-if)#switchport ?
  access         Set access mode characteristics of the interface
  backup         Set backup for the interface
  block          Disable forwarding of unknown uni/multi cast addresses
  host           Set port host
  mode           Set trunking mode of the interface
  nonegotiate    Device will not engage in negotiation protocol on this
                 interface
  port-security  Security related command
  priority       Set appliance 802.1p priority
  private-vlan   Set the private VLAN configuration
  protected      Configure an interface to be a protected port
  trunk          Set trunking characteristics of the interface
  voice          Voice appliance attributes
  <cr>

DLS2(config-if)#switchport mode ?
  access        Set trunking mode to ACCESS unconditionally
  dot1q-tunnel  set trunking mode to TUNNEL unconditionally
  dynamic       Set trunking mode to dynamically negotiate access or trunk mode
  private-vlan  Set private-vlan mode
  trunk         Set trunking mode to TRUNK unconditionally

DLS2(config-if)#switchport mode private-vlan ?
  host         Set the mode to private-vlan host
  promiscuous  Set the mode to private-vlan promiscuous

DLS2(config-if)#switchport mode private-vlan host   // SETS THE PVLAN MODE ON THE INTERFACE
DLS2(config-if)#switchport private-vlan ?
  association       Set the private VLAN association
  host-association  Set the private VLAN host association
  mapping           Set the private VLAN promiscuous mapping

DLS2(config-if)#switchport private-vlan host-association ?
  <1006-4094>  Primary extended range VLAN ID of the private VLAN host port
               association
  <2-1001>     Primary normal range VLAN ID of the private VLAN port
               association

DLS2(config-if)#switchport private-vlan host-association 150 ?
  <1006-4094>  Secondary extended range VLAN ID of the private VLAN host port
               association
  <2-1001>     Secondary normal range VLAN ID of the private VLAN host port
               association

DLS2(config-if)#switchport private-vlan host-association 150 151    // ASSIGNS APPROPRIATE PRIMARY AND SECONDARY VLANS ON THE INTERFACE
DLS2(config-if)#exit
DLS2(config)#interface range fastethernet0/18-20
DLS2(config-if-range)#switchport mode private-vlan host
DLS2(config-if-range)#switchport private-vlan host-association 150 152

DLS2#show vlan private-vlan      // VERIFY PORTS ARE CONFIGURED FOR PVLAN AND ASSOCIATED VLANS

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
150     151       isolated          Fa0/6
150     152       community         Fa0/18, Fa0/19, Fa0/20


SERVER IN ISOLATED PVLAN 151


C:\Users\Server-151>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::4562:9b92:c15f:91ff%10
   IPv4 Address. . . . . . . . . . . : 172.16.150.6
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.150.1


C:\Users\Server-151>ping 172.16.150.1    // CAN PING VLAN 150 DEFAULT GATEWAY

Pinging 172.16.150.1 with 32 bytes of data:
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255

Ping statistics for 172.16.150.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms


C:\Users\John Lloyd>ping 172.16.150.18    // CAN'T PING HOST IN COMMUNITY PVLAN 152

Pinging 172.16.150.18 with 32 bytes of data:
Reply from 172.16.150.6: Destination host unreachable.
Reply from 172.16.150.6: Destination host unreachable.
Reply from 172.16.150.6: Destination host unreachable.
Reply from 172.16.150.6: Destination host unreachable.

Ping statistics for 172.16.150.18:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),


HOST-A IN COMMUNITY PVLAN 152

H:\Server-152-A>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::9416:ccf3:aa3:6460%11
   IPv4 Address. . . . . . . . . . . : 172.16.150.18
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.150.1


H:\Server-152-A>ping 172.16.150.1     // CAN PING VLAN 150 DEFAULT GATEWAY

Pinging 172.16.150.1 with 32 bytes of data:
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=3ms TTL=255

Ping statistics for 172.16.150.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 3ms, Average = 1ms


H:\Server-152-A>ping 172.16.150.6    // CAN'T PING HOST IN ISOLATED PVLAN 151

Pinging 172.16.150.6 with 32 bytes of data:
Reply from 172.16.150.18: Destination host unreachable.
Reply from 172.16.150.18: Destination host unreachable.
Reply from 172.16.150.18: Destination host unreachable.
Reply from 172.16.150.18: Destination host unreachable.

Ping statistics for 172.16.150.6:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),


H:\Server-152-A>ping 172.16.150.19    // CAN PING HOST B IN COMMUNITY PVLAN 152

Pinging 172.16.150.19 with 32 bytes of data:
Reply from 172.16.150.19: bytes=32 time<1ms TTL=128
Reply from 172.16.150.19: bytes=32 time=1ms TTL=128
Reply from 172.16.150.19: bytes=32 time=1ms TTL=128
Reply from 172.16.150.19: bytes=32 time<1ms TTL=128

Ping statistics for 172.16.150.19:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms


HOST B IN PVLAN 152

C:\Users\Server-152-B>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::4562:9b92:c15f:91ff%10
   IPv4 Address. . . . . . . . . . . : 172.16.150.19
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.150.1


C:\Users\Server-152-B>ping 172.16.150.1    // CAN PING VLAN 150 DEFAULT GATEWAY

Pinging 172.16.150.1 with 32 bytes of data:
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=3ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255
Reply from 172.16.150.1: bytes=32 time=1ms TTL=255

Ping statistics for 172.16.150.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 3ms, Average = 1ms


C:\Users\Server-152-B>ping 172.16.150.18    // CAN PING HOST A ON COMMUNITY PVLAN 152

Pinging 172.16.150.18 with 32 bytes of data:
Reply from 172.16.150.18: bytes=32 time=2ms TTL=128
Reply from 172.16.150.18: bytes=32 time=1ms TTL=128
Reply from 172.16.150.18: bytes=32 time=1ms TTL=128
Reply from 172.16.150.18: bytes=32 time=1ms TTL=128

Ping statistics for 172.16.150.18:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms


DLS1(config)#access-list 100 permit tcp 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255 established
DLS1(config)#access-list 100 permit icmp 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255 echo-reply
DLS1(config)#access-list 100 deny ip 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255
DLS1(config)#access-list 100 permit ip any any
DLS1(config)#interface vlan 100
DLS1(config-if)#ip access-group 100 in
DLS1(config-if)#interface vlan 200
DLS1(config-if)#ip access-group 100 in


DLS2(config)#access-list 100 permit tcp 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255 established
DLS2(config)#access-list 100 permit icmp 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255 echo-reply
DLS2(config)#access-list 100 deny ip 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255
DLS2(config)#access-list 100 permit ip any any
DLS2(config)#access-list 100 permit ip any any
DLS2(config)#interface vlan 100
DLS2(config-if)#ip access-group 100 in
DLS2(config-if)#interface vlan 200
DLS2(config-if)#ip access-group 100 in


DLS1#show access-list
Extended IP access list 100
    10 permit tcp 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255 established
    20 permit icmp 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255 echo-reply
    30 deny ip 172.16.200.0 0.0.0.255 172.16.100.0 0.0.0.255
    40 permit ip any any (162 matches)

DLS1#show ip interface vlan 100
Vlan100 is up, line protocol is up
  Internet address is 172.16.100.3/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Multicast reserved groups joined: 224.0.0.2
  Outgoing access list is not set  
  Inbound  access list is 100  
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  BGP Policy Mapping is disabled
  Input features: Access List
  Output features: Check hwidb
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled


ALS1(config)#interface fastethernet0/6
ALS1(config-if)#switchport mode access
ALS1(config-if)#switchport access vlan 100
ALS1(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast has been configured on FastEthernet0/6 but will only
 have effect when the interface is in a non-trunking mode.


ALS2(config)#interface fastethernet0/6
ALS2(config-if)#switchport mode access
ALS2(config-if)#switchport access vlan 200
ALS2(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast has been configured on FastEthernet0/6 but will only
 have effect when the interface is in a non-trunking mode.


HOST A ON VLAN 100


C:\Users\John Lloyd>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::4562:9b92:c15f:91ff%10
   IPv4 Address. . . . . . . . . . . : 172.16.100.5
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.100.1


C:\Users\John Lloyd>ping 172.16.200.8    // PING TO HOST B ON VLAN 200 ALLOWED

Pinging 172.16.200.8 with 32 bytes of data:
Reply from 172.16.200.8: bytes=32 time=1ms TTL=127
Reply from 172.16.200.8: bytes=32 time=1ms TTL=127
Reply from 172.16.200.8: bytes=32 time<1ms TTL=127
Reply from 172.16.200.8: bytes=32 time<1ms TTL=127

Ping statistics for 172.16.200.8:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms


HOST B ON VLAN 200

H:\>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::9416:ccf3:aa3:6460%11
   IPv4 Address. . . . . . . . . . . : 172.16.200.8
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.200.1


H:\>ping 172.16.100.5    // PING TO HOST A ON VLAN 100 DENIED

Pinging 172.16.100.5 with 32 bytes of data:
Reply from 172.16.200.4: Destination net unreachable.
Reply from 172.16.200.4: Destination net unreachable.
Reply from 172.16.200.4: Destination net unreachable.
Reply from 172.16.200.4: Destination net unreachable.

Ping statistics for 172.16.100.5:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),


DLS1(config)#ip access-list extended TEMP-HOST
DLS1(config-ext-nacl)#permit ip host 172.16.100.150 172.16.100.0 0.0.0.255    // DEFINE ACL TO DEFINE TRAFFIC BETWEEN HOST AND VLAN 100 SUBNET
DLS1(config-ext-nacl)#exit
DLS1(config)#vlan ?
  WORD        ISL VLAN IDs 1-4094
  access-map  Create vlan access-map or enter vlan access-map command mode
  dot1q       dot1q parameters
  filter      Apply a VLAN Map
  internal    internal VLAN

DLS1(config)#vlan access-map ?
  WORD  Vlan access map tag

DLS1(config)#vlan access-map BLOCK-TEMP ?
  <0-65535>  Sequence to insert to/delete from existing vlan access-map entry
  <cr>

DLS1(config)#vlan access-map BLOCK-TEMP 10    // VACL; DEFAULT SEQUENCE STARTS AND INCREMENTS IN 10
DLS1(config-access-map)#?
Vlan access-map configuration commands:
  action   Take the action
  default  Set a command to its defaults
  exit     Exit from vlan access-map configuration mode
  match    Match values.
  no       Negate a command or set its defaults

DLS1(config-access-map)#match ?
  ip   IP based match
  mac  MAC based match

DLS1(config-access-map)#match ip ?
  address  Match IP address to access control.

DLS1(config-access-map)#match ip address ?
  <1-199>      IP access list (standard or extended)
  <1300-2699>  IP expanded access list (standard or extended)
  WORD         Access-list name

DLS1(config-access-map)#match ip address TEMP-HOST
DLS1(config-access-map)#action ?
  drop     Drop packets
  forward  Forward packets

DLS1(config-access-map)#action drop
DLS1(config-access-map)#vlan access-map BLOCK-TEMP 20    // ALLOWS ALL OTHER TRAFFIC; IF NOT ADDED, AN IMPLICIT DENY CATCHES AND DENIES ALL TRAFFIC
DLS1(config-access-map)#action forward
DLS1(config-access-map)#exit
DLS1(config)#vlan filter ?
  WORD  VLAN map name

DLS1(config)#vlan filter BLOCK-TEMP ?
  vlan-list  VLANs to apply filter to

DLS1(config)#vlan filter BLOCK-TEMP vlan-list ?
  <1-4094>  VLAN id
  all       Add this filter to all VLANs

DLS1(config)#vlan filter BLOCK-TEMP vlan-list 100    // DEFINE THE VLAN TO APPLY VACL

DLS1#show vlan access-map BLOCK-TEMP
Vlan access-map "BLOCK-TEMP"  10
  Match clauses:
    ip  address: TEMP-HOST
  Action:
    drop
Vlan access-map "BLOCK-TEMP"  20
  Match clauses:
  Action:
    forward

DLS1(config)#interface range fastethernet0/1-2
DLS1(config-if-range)#switchport mode access
DLS1(config-if-range)#switchport access vlan 100
DLS1(config-if-range)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast will be configured in 2 interfaces due to the range command
 but will only have effect when the interfaces are in a non-trunking mode.


HOST A IN VLAN 100


C:\Users\HOST-A>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::4562:9b92:c15f:91ff%10
   IPv4 Address. . . . . . . . . . . : 172.16.100.150
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.100.1


C:\Users\HOST-A>ping 172.16.100.1    // CAN'T PING VLAN 100 DEFAULT GATEWAY

Pinging 172.16.100.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 172.16.100.1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),


C:\Users\HOST-A>ping 172.16.100.20    // CAN'T PING HOST B

Pinging 172.16.100.20 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 172.16.100.20:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),


HOST B IN VLAN 100

H:\>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::9416:ccf3:aa3:6460%11
   IPv4 Address. . . . . . . . . . . : 172.16.100.20
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.100.1

Tunnel adapter isatap.{308C6312-E0CC-42FE-ACA0-E00A2450F476}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :


H:\>ping 172.16.100.1     // CAN PING VLAN 100 DEFAULT GATEWAY

Pinging 172.16.100.1 with 32 bytes of data:
Reply from 172.16.100.1: bytes=32 time=1ms TTL=255
Reply from 172.16.100.1: bytes=32 time=1ms TTL=255
Reply from 172.16.100.1: bytes=32 time=1ms TTL=255
Reply from 172.16.100.1: bytes=32 time=2ms TTL=255

Ping statistics for 172.16.100.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms


H:\>ping 172.16.100.150    // CAN'T PING HOST A

Pinging 172.16.100.150 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 172.16.100.150:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Securing Spanning Tree Protocol (STP)

We normally use Rapid PVST+ (RPVST+) on a client site and MST for our data center core. It's important to secure STP/Layer 2 since this is where LAN users connects to the network. It's also wise to manually configure the primary and secondary root switch in STP to make troubleshooting easier.

DLS1#show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769  
             Address     0016.c756.6180
             This bridge is the root  
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     0016.c756.6180
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Desg FWD 19        128.13   P2p
Fa0/12              Desg FWD 19        128.14   P2p

DLS1(config)#spanning-tree vlan 1,100 root primary   // FOR ROOT BRIDGE TO BE PREDICTABLE AND OPTIMIZED PATHS FOR LAYER 2
DLS1(config)#spanning-tree vlan 200 root secondary


DLS2(config)#spanning-tree vlan 1,100 root secondary
DLS2(config)#spanning-tree vlan 200 root primary


DLS1#show spanning-tree

VLAN0001  
  Spanning tree enabled protocol ieee
  Root ID    Priority    24577   
             Address     0016.c756.6180
             This bridge is the root  
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    24577  (priority 24576 sys-id-ext 1)
             Address     0016.c756.6180
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Desg FWD 19        128.13   P2p
Fa0/12              Desg FWD 19        128.14   P2p


VLAN0100  
  Spanning tree enabled protocol ieee
  Root ID    Priority    24676  
             Address     0016.c756.6180
             This bridge is the root  
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    24676  (priority 24576 sys-id-ext 100)
             Address     0016.c756.6180
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Desg FWD 19        128.13   P2p
Fa0/12              Desg FWD 19        128.14   P2p

 
VLAN0200  
  Spanning tree enabled protocol ieee
  Root ID    Priority    24776  
             Address     0016.c840.3580     // DLS2 MAC ADDRESS
             Cost        19
             Port        13 (FastEthernet0/11)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    28872  (priority 28672 sys-id-ext 200)
             Address     0016.c756.6180
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Root FWD 19        128.13   P2p
Fa0/12              Altn BLK 19        128.14   P2p


DLS2#show spanning-tree

VLAN0001  
  Spanning tree enabled protocol ieee
  Root ID    Priority    24577  
             Address     0016.c756.6180     // DLS1 MAC ADDRESS
             Cost        19
             Port        13 (FastEthernet0/11)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    28673  (priority 28672 sys-id-ext 1)
             Address     0016.c840.3580
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Root FWD 19        128.13   P2p
Fa0/12              Altn BLK 19        128.14   P2p


VLAN0100  
  Spanning tree enabled protocol ieee
  Root ID    Priority    24676   
             Address     0016.c756.6180  
             Cost        19
             Port        13 (FastEthernet0/11)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    28772  (priority 28672 sys-id-ext 100)
             Address     0016.c840.3580
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Root FWD 19        128.13   P2p
Fa0/12              Altn BLK 19        128.14   P2p


VLAN0200   
  Spanning tree enabled protocol ieee
  Root ID    Priority    24776   
             Address     0016.c840.3580    
             This bridge is the root   
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    24776  (priority 24576 sys-id-ext 200)
             Address     0016.c840.3580
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Desg FWD 19        128.13   P2p
Fa0/12              Desg FWD 19        128.14   P2p


DLS2#show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    24577
             Address     0016.c756.6180
             Cost        19
             Port        13 (FastEthernet0/11)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    28673  (priority 28672 sys-id-ext 1)
             Address     0016.c840.3580
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 15

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/7               Desg FWD 19        128.9    P2p
Fa0/8               Desg FWD 19        128.10   P2p
Fa0/9               Desg FWD 19        128.11   P2p
Fa0/10              Desg FWD 19        128.12   P2p
Fa0/11              Root FWD 19        128.13   P2p   
Fa0/12              Altn BLK 19        128.14   P2p


DLS2(config)#interface fastethernet0/11
DLS2(config-if)#spanning-tree ?
  bpdufilter     Don't send or receive BPDUs on this interface
  bpduguard      Don't accept BPDUs on this interface
  cost           Change an interface's spanning tree port path cost
  guard          Change an interface's spanning tree guard mode
  link-type      Specify a link type for spanning tree protocol use
  mst            Multiple spanning tree
  port-priority  Change an interface's spanning tree port priority
  portfast       Enable an interface to move directly to forwarding on link up
  stack-port     Enable stack port
  vlan           VLAN Switch Spanning Tree

DLS2(config-if)#spanning-tree guard ?
  loop  Set guard mode to loop guard on interface
  none  Set guard mode to none
  root  Set guard mode to root guard on interface

DLS2(config-if)#spanning-tree guard root    // MAKES A PORT root-inconsistent IF A SWITCH IS CONNECTED WITH LOWER BID THAN ROOT BRIDGE
DLS2(config-if)#
*Mar  1 01:52:33.223: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port

FastEthernet0/11.
*Mar  1 01:52:34.230: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port FastEthernet0/11 on

VLAN0100.

DLS2#show spanning-tree ?
  WORD               bridge group list, example 1,3-5,7,9
  active             Report on active interfaces only
  backbonefast       Show spanning tree backbonefast status
  blockedports       Show blocked ports
  bridge             Status and configuration of this bridge
  detail             Detailed information
  inconsistentports  Show inconsistent ports
  interface          Spanning Tree interface status and configuration
  mst                Multiple spanning trees
  pathcost           Show Spanning pathcost options
  root               Status and configuration of the root bridge
  summary            Summary of port states
  uplinkfast         Show spanning tree uplinkfast status
  vlan               VLAN Switch Spanning Trees
  |                  Output modifiers
  <cr>

DLS2#show spanning-tree inconsistentports

Name                 Interface                Inconsistency
-------------------- ------------------------ ------------------
VLAN0001             FastEthernet0/11         Root Inconsistent
VLAN0100             FastEthernet0/11         Root Inconsistent

Number of inconsistent ports (segments) in the system : 2


ALS1(config)#spanning-tree ?
  backbonefast  Enable BackboneFast Feature
  etherchannel  Spanning tree etherchannel specific configuration
  extend        Spanning Tree 802.1t extensions
  logging       Enable Spanning tree logging
  loopguard     Spanning tree loopguard options
  mode          Spanning tree operating mode
  mst           Multiple spanning tree configuration
  pathcost      Spanning tree pathcost options
  portfast      Spanning tree portfast options
  transmit      STP transmit parameters
  uplinkfast    Enable UplinkFast Feature
  vlan          VLAN Switch Spanning Tree

ALS1(config)#spanning-tree portfast ?
  bpdufilter  Enable portfast bdpu filter on this switch
  bpduguard   Enable portfast bpdu guard on this switch
  default     Enable portfast by default on all access ports

ALS1(config)#spanning-tree portfast bpduguard ?
  default  Enable bdpu guard by default on all portfast ports

ALS1(config)#spanning-tree portfast bpduguard default    // MAKES AN ACCESS PORT error-disable IF IT

RECEIVES BPDUs
ALS1(config)#do show spanning-tree summary
Switch is in pvst mode
Root bridge for: none
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default  is enabled   
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
EtherChannel misconfig guard is enabled
UplinkFast                   is disabled
BackboneFast                 is disabled
Configured Pathcost method used is short

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001                     5         0        0          1          6
VLAN0100                     5         0        0          1          6
VLAN0200                     5         0        0          1          6
---------------------- -------- --------- -------- ---------- ----------
3 vlans                     15         0        0          3         18

ALS1#show run interface fastethernet0/6
Building configuration...

Current configuration : 109 bytes
!
interface FastEthernet0/6
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
end


02:04:17: %LINK-3-UPDOWN: Interface FastEthernet0/6, changed state to up
02:04:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/6, changed state to up
02:04:18: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/6 with BPDU Guard enabled. Disabling port.
02:04:18: %PM-4-ERR_DISABLE: bpduguard error detected on Fa0/6, putting Fa0/6 in err-disable state
02:04:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/6, changed state to down
02:04:20: %LINK-3-UPDOWN: Interface FastEthernet0/6, changed state to down
ALS1#show interface fastethernet0/6
FastEthernet0/6 is down, line protocol is down (err-disabled)  
  Hardware is Fast Ethernet, address is 6416.8dec.a707 (bia 6416.8dec.a707)
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100BaseTX
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:16, output 00:00:16, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     6125 packets input, 1320320 bytes, 0 no buffer
     Received 6040 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 4134 multicast, 0 pause input
     0 input packets with dribble condition detected
     3788 packets output, 269527 bytes, 0 underruns
     0 output errors, 0 collisions, 7 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out


ALS1(config)#interface fastethernet0/6
ALS1(config-if)#storm-control ?
  action     Action to take for storm-control
  broadcast  Broadcast address storm control
  multicast  Multicast address storm control
  unicast    Unicast address storm control

ALS1(config-if)#storm-control broadcast ?
  level  Set storm suppression level on this interface

ALS1(config-if)#storm-control broadcast level ?
  <0.00 - 100.00>  Enter rising threshold
  bps              Enter suppression level in bits per second
  pps              Enter suppression level in packets per second

ALS1(config-if)#storm-control broadcast level 50    // TO CONTROL BROADCAST STORM ON AN UNMANAGED SWITCH

ALS1#sh run interface fastethernet0/6
Building configuration...

Current configuration : 131 bytes
!
interface FastEthernet0/6
 switchport trunk encapsulation dot1q
 switchport mode trunk
 storm-control broadcast level 50.00
end


DLS1(config)#udld ?
  aggressive  Enable UDLD protocol in aggressive mode on fiber ports except
              where locally configured
  enable      Enable UDLD protocol on fiber ports except where locally
              configured
  message     Set UDLD message parameters

DLS1(config)#udld aggressive    // AGGRESSIVE KEYWORD PUTS A FIBER INTERFACE TO error-disable WHEN A UNIDIRECTIONAL LINK IS DETECTED; LOOP GUARD CAN BE CONFIGURED AS AN ALTERNATIVE; CAN ALSO CONFIGURE BOTH OR ON AN ETHERCHANNEL LINK

DLS1#show udld gigabitethernet0/1

Interface Gi0/1
---
Port enable administrative configuration setting: Follows device default
Port enable operational state: Enabled / in aggressive mode  
Current bidirectional state: Unknown
Current operational state: Link down
Message interval: 7
Time out interval: 5
No neighbor cache information stored

Hot Standby Router Protocol (HSRP)

We implement HSRP in our core routers so that whenever we perform network maintenance, there's minimal impact in our network infrastructure. We allocate a /29 IP address subnet that would be assigned for the HSRP Virtual IP (VIP), PE Router 1, PE Router 2 and for other device such as ASA firewall context/gateway.

We usually buy the Cisco 3560/3750 Catalyst switch but it's already nearing EOS/EOL this year. We're now getting the Cisco 3650 Catalyst switch but I recently encountered an error in one that was deployed to a client:

May 13 14:01:09.903 UTC: %AAA-3-ACCT_LOW_MEM_UID_FAIL: AAA unable to create UID for incoming calls due to insufficient processor memory

A reboot of the switch usually resolves this kind of memory issue but the error might re-occur in the future. So I did an switch IOS upgrade instead to avoid any risk. The switch's CPU and memory usage greatly improved afterwards.

3560X#show version | inc IOS
Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 15.0(2)SE2, RELEASE SOFTWARE (fc1)

3560X(config)#boot system flash:c3560e-universalk9-mz.150-2.SE7.bin 
3560X(config)#do show run | inc boot
boot-start-marker
boot-end-marker
3560X(config)#do show boot
BOOT path-list      : flash:c3560e-universalk9-mz.150-2.SE7.bin
Config file         : flash:/config.text
Private Config file : flash:/private-config.text
Enable Break        : no
Manual Boot         : no
HELPER path-list    :
Auto upgrade        : yes
Auto upgrade path   :
NVRAM/Config file
      buffer size:   524288
Timeout for Config
          Download:    0 seconds
Config Download
       via DHCP:       disabled (next boot: disabled)

<RELOAD>

3560X#show version | inc IOS
Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 15.0(2)SE7, RELEASE SOFTWARE (fc1)

The switch's memory usage of the switch significantly dropped from 94% down to 21%.

I learned a connector tip in MS Visio 2010 where the lines "jump" or arc with each other to make it look cleaner. It's located under Home > Connector. Draw or make a line and copy/paste another line.

 

ALS1(config)#enable secret cisco
ALS1(config)#line vty 0 15
ALS1(config-line)#password cisco
ALS1(config-line)#login
ALS1(config-line)#exit
ALS1(config)#interface vlan 1
ALS1(config-if)#ip address 172.16.1.101 255.255.255.0
ALS1(config-if)#no shutdown
ALS1(config-if)#
00:04:45: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
00:04:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up


ALS2(config)#enable secret cisco
ALS2(config)#line vty 0 15
ALS2(config-line)#password cisco
ALS2(config-line)#login
ALS2(config-line)#exit
ALS2(config)#interface vlan 1
ALS2(config-if)#ip address 172.16.1.102 255.255.255.0
ALS2(config-if)#no shutdown


DLS1(config)#enable secret cisco
DLS1(config)#line vty 0 15
DLS1(config-line)#password cisco
DLS1(config-line)#login
DLS1(config-line)#interface vlan 1
DLS1(config-if)#ip address 172.16.1.3 255.255.255.0
DLS1(config-if)#no shutdown
DLS1(config-if)#
*Mar  1 00:05:59.485: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Mar  1 00:06:00.492: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up


DLS2(config)#enable secret cisco
DLS2(config)#line vty 0 15
DLS2(config-line)#password cisco
DLS2(config-line)#login
DLS2(config-line)#exit
DLS2(config)#interface vlan 1
DLS2(config-if)#ip address 172.16.1.4 255.255.255.0
DLS2(config-if)#no shutdown
DLS2(config-if)#
*Mar  1 00:07:19.286: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Mar  1 00:07:20.292: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up


ALS1(config)#ip default-gateway 172.16.1.1


ALS2(config)#ip default-gateway 172.16.1.1


DLS1(config)#interface range fastethernet0/7-8
DLS1(config-if-range)#shutdown     // IT'S A GOOD PRACTICE TO SHUTDOWN PORTS BEFORE PORT CHANNEL IS CREATED
*Mar  1 00:09:20.249: %LINK-5-CHANGED: Interface FastEthernet0/7, changed state to administratively down
*Mar  1 00:09:20.258: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
*Mar  1 00:09:21.256: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to down
*Mar  1 00:09:21.264: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
DLS1(config-if-range)#switchport trunk encapsulation dot1q
DLS1(config-if-range)#switchport mode trunk
DLS1(config-if-range)#channel-group 1 mode desirable
Creating a port-channel interface Port-channel 1

DLS1(config-if-range)#no shutdown
DLS1(config-if-range)#
*Mar  1 00:10:02.343: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to up
*Mar  1 00:10:02.352: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
*Mar  1 00:10:14.968: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to up
*Mar  1 00:10:15.908: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up

DLS1(config-if-range)#interface range fastethernet0/9-10
DLS1(config-if-range)#shutdown
DLS1(config-if-range)#
*Mar  1 00:11:17.430: %LINK-5-CHANGED: Interface FastEthernet0/9, changed state to administratively down
*Mar  1 00:11:17.438: %LINK-5-CHANGED: Interface FastEthernet0/10, changed state to administratively down
*Mar  1 00:11:18.437: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/9, changed state to down
*Mar  1 00:11:18.445: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to down
DLS1(config-if-range)#switchport trunk encapsulation dot1q
DLS1(config-if-range)#switchport mode trunk
DLS1(config-if-range)#channel-group 2 mode desirable
Creating a port-channel interface Port-channel 2

DLS1(config-if-range)#no shutdown
DLS1(config-if-range)#
*Mar  1 00:11:40.767: %LINK-3-UPDOWN: Interface FastEthernet0/9, changed state to up
*Mar  1 00:11:40.767: %LINK-3-UPDOWN: Interface FastEthernet0/10, changed state to up
*Mar  1 00:11:53.325: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/9, changed state to up
*Mar  1 00:11:53.350: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to up

DLS1(config-if-range)#interface range fastethernet0/11-12
DLS1(config-if-range)#shutdown
DLS1(config-if-range)#switchport trunk encapsulation dot1q
*Mar  1 00:12:35.041: %LINK-5-CHANGED: Interface FastEthernet0/11, changed state to administratively down
*Mar  1 00:12:35.050: %LINK-5-CHANGED: Interface FastEthernet0/12, changed state to administratively down
*Mar  1 00:12:35.060: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to down
*Mar  1 00:12:36.074: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/12, changed state to down
DLS1(config-if-range)#switchport mode trunk
DLS1(config-if-range)#channel-group 3 mode desirable
Creating a port-channel interface Port-channel 3

DLS1(config-if-range)#no shutdown
DLS1(config-if-range)#
*Mar  1 00:12:57.456: %LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to up
*Mar  1 00:12:57.464: %LINK-3-UPDOWN: Interface FastEthernet0/12, changed state to up
*Mar  1 00:13:10.626: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to up
*Mar  1 00:13:10.668: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/12, changed state to up


DLS2(config)#interface range fastethernet0/7-8
DLS2(config-if-range)#shutdown
DLS2(config-if-range)#
*Mar  1 00:15:56.720: %LINK-5-CHANGED: Interface FastEthernet0/7, changed state to administratively down
*Mar  1 00:15:56.737: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
*Mar  1 00:15:57.727: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to down
*Mar  1 00:15:57.744: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
DLS2(config-if-range)#switchport trunk encapsulation dot1q
DLS2(config-if-range)#switchport mode trunk
DLS2(config-if-range)#channel-group 1 mode desirable
Creating a port-channel interface Port-channel 1

DLS2(config-if-range)#no shutdown
DLS2(config-if-range)#
*Mar  1 00:16:21.467: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to up
*Mar  1 00:16:21.475: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
*Mar  1 00:16:34.242: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
*Mar  1 00:16:34.997: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to up

DLS2(config)#interface range fastethernet0/9-10
DLS2(config-if-range)#shutdown
DLS2(config-if-range)#
*Mar  1 00:17:15.162: %LINK-5-CHANGED: Interface FastEthernet0/9, changed state to administratively down
*Mar  1 00:17:15.179: %LINK-5-CHANGED: Interface FastEthernet0/10, changed state to administratively down
*Mar  1 00:17:16.169: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/9, changed state to down
*Mar  1 00:17:16.185: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to down
DLS2(config-if-range)#switchport trunk encapsulation dot1q
DLS2(config-if-range)#switchport mode trunk
DLS2(config-if-range)#channel-group 2 mode desirable
Creating a port-channel interface Port-channel 2

DLS2(config-if-range)#no shutdown
DLS2(config-if-range)#
*Mar  1 00:17:37.568: %LINK-3-UPDOWN: Interface FastEthernet0/9, changed state to up
*Mar  1 00:17:37.576: %LINK-3-UPDOWN: Interface FastEthernet0/10, changed state to up
*Mar  1 00:17:50.688: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/9, changed state to up
*Mar  1 00:17:50.965: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to up

DLS2(config)#interface range fastethernet0/11-12
DLS2(config-if-range)#shutdown
*Mar  1 00:18:18.773: %LINK-5-CHANGED: Interface FastEthernet0/11, changed state to administratively down
*Mar  1 00:18:18.798: %LINK-5-CHANGED: Interface FastEthernet0/12, changed state to administratively down
*Mar  1 00:18:19.780: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to down
*Mar  1 00:18:19.805: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/12, changed state to down
DLS2(config-if-range)#switchport trunk encapsulation dot1q
DLS2(config-if-range)#switchport mode trunk
DLS2(config-if-range)#channel-group 3 mode desirable
Creating a port-channel interface Port-channel 3

DLS2(config-if-range)#no shutdown
DLS2(config-if-range)#
*Mar  1 00:18:45.776: %LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to up
*Mar  1 00:18:45.784: %LINK-3-UPDOWN: Interface FastEthernet0/12, changed state to up
*Mar  1 00:18:51.598: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to up
*Mar  1 00:18:51.631: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/12, changed state to up
*Mar  1 00:18:52.587: %LINK-3-UPDOWN: Interface Port-channel3, changed state to up
*Mar  1 00:18:53.594: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel3, changed state to up


ALS1(config)#interface range fastethernet0/7-8
ALS1(config-if-range)#shutdown
ALS1(config-if-range)#
00:22:14: %LINK-5-CHANGED: Interface FastEthernet0/7, changed state to administratively down
00:22:14: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
00:22:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to down
00:22:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
ALS1(config-if-range)#switchport trunk encapsulation dot1q
ALS1(config-if-range)#switchport mode trunk
ALS1(config-if-range)#channel-group 1 mode desirable
Creating a port-channel interface Port-channel 1

ALS1(config-if-range)#no shutdown
ALS1(config-if-range)#
00:22:43: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to up
00:22:43: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
00:22:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to up
00:22:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
00:22:49: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up
00:22:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to up

ALS1(config)#interface range fastethernet0/4-5
ALS1(config-if-range)#shutdown
ALS1(config-if-range)#
00:29:07: %LINK-5-CHANGED: Interface FastEthernet0/4, changed state to administratively down
00:29:07: %LINK-5-CHANGED: Interface FastEthernet0/5, changed state to administratively down
00:29:08: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to down
00:29:08: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to down
ALS1(config-if-range)#switchport trunk encapsulation dot1q
ALS1(config-if-range)#switchport mode trunk
ALS1(config-if-range)#channel-group 2 mode desirable
Creating a port-channel interface Port-channel 2

ALS1(config-if-range)#no shutdown
ALS1(config-if-range)#
00:29:38: %LINK-3-UPDOWN: Interface FastEthernet0/4, changed state to up
00:29:38: %LINK-3-UPDOWN: Interface FastEthernet0/5, changed state to up
00:29:44: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up
00:29:44: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to up
00:29:45: %LINK-3-UPDOWN: Interface Port-channel2, changed state to up
00:29:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel2, changed state to up

ALS1(config)#interface range fastethernet0/1-2
ALS1(config-if-range)#shutdown
ALS1(config-if-range)#
00:30:45: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down
00:30:45: %LINK-5-CHANGED: Interface FastEthernet0/2, changed state to administratively down
00:30:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
00:30:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down
ALS1(config-if-range)#switchport trunk encapsulation dot1q
ALS1(config-if-range)#switchport mode trunk
ALS1(config-if-range)#channel-group 3 mode desirable
Creating a port-channel interface Port-channel 3

ALS1(config-if-range)#no shutdown
ALS1(config-if-range)#
00:31:11: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
00:31:11: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to up
00:31:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up
00:31:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up


ALS2(config)#interface range fastethernet0/7-8
ALS2(config-if-range)#shutdown
ALS2(config-if-range)#
00:32:30: %LINK-5-CHANGED: Interface FastEthernet0/7, changed state to administratively down
00:32:31: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
00:32:32: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to down
ALS2(config-if-range)#
00:32:32: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
ALS2(config-if-range)#switchport trunk encapsulation dot1q
ALS2(config-if-range)#switchport mode trunk
ALS2(config-if-range)#channel-group 1 mode desirable
Creating a port-channel interface Port-channel 1

ALS2(config-if-range)#no shutdown
ALS2(config-if-range)#
00:33:02: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to up
00:33:02: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
ALS2(config-if-range)#
00:33:07: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to up
00:33:07: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
ALS2(config-if-range)#
00:33:08: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up
00:33:09: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to up

ALS2(config)#interface range fastethernet0/4-5
ALS2(config-if-range)#switchport trunk encapsulation dot1q
ALS2(config-if-range)#switchport mode trunk
ALS2(config-if-range)#channel-group 2 mode desirable
Creating a port-channel interface Port-channel 2

ALS2(config-if-range)#
00:33:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to down
00:33:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
00:33:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to down
ALS2(config-if-range)#
00:33:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel2, changed state to up
00:33:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to up
00:33:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up
ALS2(config-if-range)#
00:33:53: %LINK-3-UPDOWN: Interface Port-channel2, changed state to up

ALS2(config)#interface range fastethernet0/1-2
ALS2(config-if-range)#switchport trunk encapsulation dot1q
ALS2(config-if-range)#switchport mode trunk
ALS2(config-if-range)#channel-group 3 mode desirable
Creating a port-channel interface Port-channel 3

ALS2(config-if-range)#
00:35:00: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
00:35:01: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down
ALS2(config-if-range)#
00:35:02: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel3, changed state to up
00:35:03: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
00:35:03: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up
ALS2(config-if-range)#
00:35:04: %LINK-3-UPDOWN: Interface Port-channel3, changed state to up


DLS1#show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Po1         on               802.1q         trunking      1
Po2         on               802.1q         trunking      1
Po3         on               802.1q         trunking      1

Port        Vlans allowed on trunk
Po1         1-4094
Po2         1-4094
Po3         1-4094

Port        Vlans allowed and active in management domain
Po1         1
Po2         1
Po3         1

Port        Vlans in spanning tree forwarding state and not pruned
Po1         1
Po2         1
Po3         1

DLS1#show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 3
Number of aggregators:           3

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         PAgP      Fa0/7(P)    Fa0/8(P)
2      Po2(SU)         PAgP      Fa0/9(P)    Fa0/10(P)
3      Po3(SU)         PAgP      Fa0/11(P)   Fa0/12(P)


DLS2#show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Po1         on               802.1q         trunking      1
Po2         on               802.1q         trunking      1
Po3         on               802.1q         trunking      1

Port        Vlans allowed on trunk
Po1         1-4094
Po2         1-4094
Po3         1-4094

Port        Vlans allowed and active in management domain
Po1         1
Po2         1
Po3         1

Port        Vlans in spanning tree forwarding state and not pruned
Po1         1
Po2         1
Po3         1

DLS2#show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 3
Number of aggregators:           3

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         PAgP      Fa0/7(P)    Fa0/8(P)
2      Po2(SU)         PAgP      Fa0/9(P)    Fa0/10(P)
3      Po3(SU)         PAgP      Fa0/11(P)   Fa0/12(P)


ALS1#show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Po1         on           802.1q         trunking      1
Po2         on           802.1q         trunking      1
Po3         on           802.1q         trunking      1

Port        Vlans allowed on trunk
Po1         1-4094
Po2         1-4094
Po3         1-4094

Port        Vlans allowed and active in management domain
Po1         1
Po2         1
Po3         1

Port        Vlans in spanning tree forwarding state and not pruned
Po1         1
Po2         none
Po3         none

ALS1#show etherchannel summary
Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 3
Number of aggregators:           3

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         PAgP      Fa0/7(P)    Fa0/8(P)
2      Po2(SU)         PAgP      Fa0/4(P)    Fa0/5(P)
3      Po3(SU)         PAgP      Fa0/1(P)    Fa0/2(P)


ALS2#show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Po1         on           802.1q         trunking      1
Po2         on           802.1q         trunking      1
Po3         on           802.1q         trunking      1

Port        Vlans allowed on trunk
Po1         1-4094
Po2         1-4094
Po3         1-4094

Port        Vlans allowed and active in management domain
Po1         1
Po2         1
Po3         1

Port        Vlans in spanning tree forwarding state and not pruned
Po1         none
Po2         1
Po3         1

ALS2#show etherchannel summary
Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 3
Number of aggregators:           3

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         PAgP      Fa0/7(P)    Fa0/8(P)
2      Po2(SU)         PAgP      Fa0/4(P)    Fa0/5(P)
3      Po3(SU)         PAgP      Fa0/1(P)    Fa0/2(P)


ALS1(config)#vtp mode client
Setting device to VTP CLIENT mode.
ALS1(config)#do show vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 5
VTP Operating Mode              : Client
VTP Domain Name                 :
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00


ALS2(config)#vtp mode client
Setting device to VTP CLIENT mode.
ALS2(config)#do show vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 5
VTP Operating Mode              : Client
VTP Domain Name                 :
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00


DLS1(config)#vtp domain SWPOD
Changing VTP domain name from NULL to SWPOD
DLS1(config)#v
*Mar  1 00:39:23.146: %SW_VLAN-6-VTP_DOMAIN_NAME_CHG: VTP domain name changed to SWPOD
DLS1(config)#vtp version 2
DLS1(config)#vlan 10
DLS1(config-vlan)#name Finance
DLS1(config-vlan)#vlan 20
DLS1(config-vlan)#name Engineering
DLS1(config-vlan)#vlan 30
DLS1(config-vlan)#name Server-Farm1
DLS1(config-vlan)#vlan 40
DLS1(config-vlan)#name Server-Farm2

DLS1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/13, Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
10   Finance                          active
20   Engineering                      active
30   Server-Farm1                     active
40   Server-Farm2                     active
1002 fddi-default                     act/unsup
1003 trcrf-default                    act/unsup
1004 fddinet-default                  act/unsup
1005 trbrf-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
10   enet  100010     1500  -      -      -        -    -        0      0
20   enet  100020     1500  -      -      -        -    -        0      0
30   enet  100030     1500  -      -      -        -    -        0      0

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
40   enet  100040     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 trcrf 101003     4472  1005   3276   -        -    srb      0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trbrf 101005     4472  -      -      15       ibm  -        0      0


VLAN AREHops STEHops Backup CRF
---- ------- ------- ----------
1003 7       7       off

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

DLS1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/13, Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
10   Finance                          active
20   Engineering                      active
30   Server-Farm1                     active
40   Server-Farm2                     active
1002 fddi-default                     act/unsup
1003 trcrf-default                    act/unsup
1004 fddinet-default                  act/unsup
1005 trbrf-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
10   enet  100010     1500  -      -      -        -    -        0      0
20   enet  100020     1500  -      -      -        -    -        0      0
30   enet  100030     1500  -      -      -        -    -        0      0

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
40   enet  100040     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 trcrf 101003     4472  1005   3276   -        -    srb      0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trbrf 101005     4472  -      -      15       ibm  -        0      0


VLAN AREHops STEHops Backup CRF
---- ------- ------- ----------
1003 7       7       off

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

DLS1#show vtp status
VTP Version                     : running VTP2
Configuration Revision          : 5
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 9
VTP Operating Mode              : Server
VTP Domain Name                 : SWPOD
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Enabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x7F 0x53 0x2C 0x4F 0xA6 0x4F 0x7E 0x34
Configuration last modified by 172.16.1.3 at 3-1-93 00:40:15
Local updater ID is 172.16.1.3 on interface Vl1 (lowest numbered VLAN interface found)


DLS1(config)#interface fastethernet0/6
DLS1(config-if)#switchport mode access
DLS1(config-if)#switchport access vlan 30
DLS1(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast has been configured on FastEthernet0/6 but will only
 have effect when the interface is in a non-trunking mode.


DLS2(config)#interface fastethernet0/6
DLS2(config-if)#switchport mode access
DLS2(config-if)#switchport access vlan 40
DLS2(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast has been configured on FastEthernet0/6 but will only
 have effect when the interface is in a non-trunking mode.


ALS1(config)#interface fastethernet0/6
ALS1(config-if)#switchport mode access
ALS1(config-if)#switchport access vlan 10
ALS1(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast has been configured on FastEthernet0/6 but will only
 have effect when the interface is in a non-trunking mode.


ALS2(config)#interface fastethernet0/6
ALS2(config-if)#switchport mode access
ALS2(config-if)#switchport access vlan 20
ALS2(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

%Portfast has been configured on FastEthernet0/6 but will only
 have effect when the interface is in a non-trunking mode.


Payroll (Host A):

C:\Users\Payroll>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::4562:9b92:c15f:91ff%10
   IPv4 Address. . . . . . . . . . . : 172.16.10.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.10.1

C:\Users\Payroll>ping 172.16.40.100    // PING FROM PAYROLL HOST A TO SQL SERVER

Pinging 172.16.40.100 with 32 bytes of data:
Reply from 172.16.10.100: Destination host unreachable.
Reply from 172.16.10.100: Destination host unreachable.
Reply from 172.16.10.100: Destination host unreachable.
Reply from 172.16.10.100: Destination host unreachable.

Ping statistics for 172.16.40.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),


DLS1(config)#interface vlan 1
DLS1(config-if)#standby 1 ip 172.16.1.1    // VIRTUAL GATEWAY IP
DLS1(config-if)#standby 1 preempt    // ALLOWS ROUTER WITH HIGHER PRIORITY TO BECOME ACTIVE
DLS1(config-if)#standby 1 priority 150     // DLS1 IS THE ACTIVE ROUTER FOR VLANs 1, 10, AND 20 SINCE PRIORITY IS HIGHER (150 > 100)
DLS1(config-if)#exit
DLS1(config)#interface vlan 10
*Mar  1 00:59:12.617: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
*Mar  1 00:59:17.868: %HSRP-5-STATECHANGE: Vlan1 Grp 1 state Speak -> Standby
*Mar  1 00:59:18.363: %HSRP-5-STATECHANGE: Vlan1 Grp 1 state Standby -> Active
DLS1(config-if)#ip address 172.16.10.3 255.255.255.0
DLS1(config-if)#standby 1 ip 172.16.10.1
DLS1(config-if)#standby 1 preempt
DLS1(config-if)#standby 1 priority 150
DLS1(config-if)#exit
DLS1(config)#
*Mar  1 01:00:05.767: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Speak -> Standby
*Mar  1 01:00:06.262: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Standby -> Active
DLS1(config)#interface vlan 20
*Mar  1 01:00:19.726: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up
DLS1(config-if)#ip address 172.16.20.3 255.255.255.0
DLS1(config-if)#standby 1 ip 172.16.20.1
DLS1(config-if)#standby 1 preempt
DLS1(config-if)#standby 1 priority 150
DLS1(config-if)#exit
DLS1(config)#
*Mar  1 01:01:03.514: %HSRP-5-STATECHANGE: Vlan20 Grp 1 state Speak -> Standby
*Mar  1 01:01:04.009: %HSRP-5-STATECHANGE: Vlan20 Grp 1 state Standby -> Active
DLS1(config)#interface vlan 30
DLS1(config-if)#
*Mar  1 01:01:12.758: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan30, changed state to up
DLS1(config-if)#ip address 172.16.30.3 255.255.255.0
DLS1(config-if)#standby 1 ip 172.16.30.1
DLS1(config-if)#standby 1 preempt
DLS1(config-if)#standby 1 priority 100     // DLS1 IS THE STANDBY ROUTER FOR VLANs 30 AND 40
DLS1(config-if)#exit
DLS1(config)#
*Mar  1 01:01:54.400: %HSRP-5-STATECHANGE: Vlan30 Grp 1 state Speak -> Standby
*Mar  1 01:01:54.903: %HSRP-5-STATECHANGE: Vlan30 Grp 1 state Standby -> Active
DLS1(config)#interface vlan 40
DLS1(config-if)#
*Mar  1 01:02:03.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan40, changed state to up
DLS1(config-if)#ip address 172.16.40.3 255.255.255.0
DLS1(config-if)#standby 1 ip 172.16.40.1
DLS1(config-if)#standby 1 preempt
DLS1(config-if)#standby 1 priority 100
DLS1(config-if)#
*Mar  1 01:03:40.943: %HSRP-5-STATECHANGE: Vlan40 Grp 1 state Speak -> Standby
*Mar  1 01:03:41.438: %HSRP-5-STATECHANGE: Vlan40 Grp 1 state Standby -> Active


DLS2(config)#ip routing
DLS2(config)#interface vlan 1
DLS2(config-if)#standby 1 ip 172.16.1.1
DLS2(config-if)#standby 1 preempt
DLS2(config-if)#standby 1 priority 100     // DLS2 IS THE STANDBY ROUTER FOR VLANs 1, 10 AND 20
DLS2(config-if)#exit
DLS2(config)#
*Mar  1 01:09:26.713: %HSRP-5-STATECHANGE: Vlan1 Grp 1 state Speak -> Standby
DLS2(config)#interface vlan 10
DLS2(config-if)#
*Mar  1 01:09:50.378: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
DLS2(config-if)#ip address 172.16.10.4 255.255.255.0
DLS2(config-if)#standby 1 ip 172.16.10.1
DLS2(config-if)#standby 1 preempt
DLS2(config-if)#standby 1 priority 100
DLS2(config-if)#exit
DLS2(config)#
*Mar  1 01:10:33.671: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Speak -> Standby
DLS2(config)#interface vlan 20
DLS2(config-if)#
*Mar  1 01:10:53.401: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up
DLS2(config-if)#ip address 172.16.20.4 255.255.255.0
DLS2(config-if)#standby 1 ip 172.16.20.1
DLS2(config-if)#standby 1 preempt
DLS2(config-if)#standby 1 priority 100
DLS2(config-if)#exit
DLS2(config)#
*Mar  1 01:11:31.930: %HSRP-5-STATECHANGE: Vlan20 Grp 1 state Speak -> Standby
DLS2(config)#interface vlan 30
DLS2(config-if)#
*Mar  1 01:11:55.468: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan30, changed state to up
DLS2(config-if)#ip address 172.16.30.4 255.255.255.0
DLS2(config-if)#standby 1 ip 172.16.30.1
DLS2(config-if)#standby 1 preempt
DLS2(config-if)#standby 1 priority 150     // DLS2 IS THE ACTIVE ROUTER FOR VLANs 30 AND 40
DLS2(config-if)#exit
DLS2(config)#
*Mar  1 01:12:21.096: %HSRP-5-STATECHANGE: Vlan30 Grp 1 state Listen -> Active
DLS2(config)#interface vlan 40
DLS2(config-if)#
*Mar  1 01:12:35.272: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan40, changed state to up
DLS2(config-if)#ip address 172.16.40.4 255.255.255.0
DLS2(config-if)#standby 1 ip 172.16.40.1
DLS2(config-if)#standby 1 preempt
DLS2(config-if)#standby 1 priority 150
DLS2(config-if)#
*Mar  1 01:13:04.440: %HSRP-5-STATECHANGE: Vlan40 Grp 1 state Listen -> Active


DLS1#show standby
Vlan1 - Group 1  
  State is Active   
    2 state changes, last state change 00:14:49
  Virtual IP address is 172.16.1.1  
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec   
    Next hello sent in 2.128 secs
  Preemption enabled
  Active router is local  
  Standby router is 172.16.1.4, priority 100 (expires in 9.396 sec)   
  Priority 150 (configured 150)
  IP redundancy name is "hsrp-Vl1-1" (default)
Vlan10 - Group 1  
  State is Active  
    2 state changes, last state change 00:14:02
  Virtual IP address is 172.16.10.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.541 secs
  Preemption enabled
  Active router is local
  Standby router is 172.16.10.4, priority 100 (expires in 7.894 sec)
  Priority 150 (configured 150)
  IP redundancy name is "hsrp-Vl10-1" (default)
Vlan20 - Group 1  
  State is Active   
    2 state changes, last state change 00:13:06
  Virtual IP address is 172.16.20.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.400 secs
  Preemption enabled
  Active router is local
  Standby router is 172.16.20.4, priority 100 (expires in 8.800 sec)
  Priority 150 (configured 150)
  IP redundancy name is "hsrp-Vl20-1" (default)
Vlan30 - Group 1   
  State is Standby   
    4 state changes, last state change 00:02:08
  Virtual IP address is 172.16.30.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.480 secs
  Preemption enabled
  Active router is 172.16.30.4, priority 150 (expires in 8.482 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Vl30-1" (default)
Vlan40 - Group 1   
  State is Standby   
    4 state changes, last state change 00:01:32
  Virtual IP address is 172.16.40.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.190 secs
  Preemption enabled
  Active router is 172.16.40.4, priority 150 (expires in 9.195 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Vl40-1" (default)


DLS2#show standby
Vlan1 - Group 1   
  State is Standby  
    1 state change, last state change 00:06:30
  Virtual IP address is 172.16.1.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.249 secs
  Preemption enabled
  Active router is 172.16.1.3, priority 150 (expires in 9.984 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Vl1-1" (default)
Vlan10 - Group 1  
  State is Standby  
    1 state change, last state change 00:05:23
  Virtual IP address is 172.16.10.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.508 secs
  Preemption enabled
  Active router is 172.16.10.3, priority 150 (expires in 9.396 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Vl10-1" (default)
Vlan20 - Group 1  
  State is Standby   
    1 state change, last state change 00:04:26
  Virtual IP address is 172.16.20.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.506 secs
  Preemption enabled
  Active router is 172.16.20.3, priority 150 (expires in 8.943 sec)
  Standby router is local
  Priority 100 (default 100)
  IP redundancy name is "hsrp-Vl20-1" (default)
Vlan30 - Group 1   
  State is Active   
    1 state change, last state change 00:03:37
  Virtual IP address is 172.16.30.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.929 secs
  Preemption enabled
  Active router is local
  Standby router is 172.16.30.3, priority 100 (expires in 8.927 sec)
  Priority 150 (configured 150)
  IP redundancy name is "hsrp-Vl30-1" (default)
Vlan40 - Group 1   
  State is Active   
    1 state change, last state change 00:02:54
  Virtual IP address is 172.16.40.1
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.641 secs
  Preemption enabled
  Active router is local
  Standby router is 172.16.40.3, priority 100 (expires in 9.639 sec)
  Priority 150 (configured 150)
  IP redundancy name is "hsrp-Vl40-1" (default)


DLS1#show standby ?
  BVI              Bridge-Group Virtual Interface
  FastEthernet     FastEthernet IEEE 802.3
  GigabitEthernet  GigabitEthernet IEEE 802.3z
  Port-channel     Ethernet Channel of interfaces
  Vlan             Catalyst Vlans
  all              Include groups in disabled state
  brief            Brief output
  capability       HSRP capability
  delay            Group initialisation delay
  internal         Internal HSRP information
  redirect         HSRP ICMP redirect information
  |                Output modifiers
  <cr>

DLS1#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   150  P Active   local           172.16.1.4      172.16.1.1
Vl10        1   150  P Active   local           172.16.10.4     172.16.10.1
Vl20        1   150  P Active   local           172.16.20.4     172.16.20.1
Vl30        1   100  P Standby  172.16.30.4     local           172.16.30.1
Vl40        1   100  P Standby  172.16.40.4     local           172.16.40.1


DLS2#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   100  P Standby  172.16.1.3      local           172.16.1.1
Vl10        1   100  P Standby  172.16.10.3     local           172.16.10.1
Vl20        1   100  P Standby  172.16.20.3     local           172.16.20.1
Vl30        1   150  P Active   local           172.16.30.3     172.16.30.1
Vl40        1   150  P Active   local           172.16.40.3     172.16.40.1


DLS1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 5 subnets
C       172.16.40.0 is directly connected, Vlan40
C       172.16.30.0 is directly connected, Vlan30
C       172.16.20.0 is directly connected, Vlan20
C       172.16.10.0 is directly connected, Vlan10
C       172.16.1.0 is directly connected, Vlan1


DLS2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 5 subnets
C       172.16.40.0 is directly connected, Vlan40
C       172.16.30.0 is directly connected, Vlan30
C       172.16.20.0 is directly connected, Vlan20
C       172.16.10.0 is directly connected, Vlan10
C       172.16.1.0 is directly connected, Vlan1


C:\Users\Payroll>ping 172.16.40.100    // PING FROM PAYROLL HOST A TO SQL SERVER

Pinging 172.16.40.100 with 32 bytes of data:
Reply from 172.16.40.100: bytes=32 time=1ms TTL=127
Reply from 172.16.40.100: bytes=32 time=1ms TTL=127
Reply from 172.16.40.100: bytes=32 time<1ms TTL=127
Reply from 172.16.40.100: bytes=32 time=1ms TTL=127

Ping statistics for 172.16.40.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

C:\Users\Payroll>tracert 172.16.40.100

Tracing route to 172.16.40.100 over a maximum of 30 hops

  1     2 ms    <1 ms     1 ms  172.16.10.3     // DLS1
  2     1 ms    <1 ms    <1 ms  172.16.40.100

Trace complete.


SQL-Server:

C:\Users\SQL-Server>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::9416:ccf3:aa3:6460%11
   IPv4 Address. . . . . . . . . . . : 172.16.40.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.40.1


C:\Users\SQL-Server>ping 172.16.20.100     // PING FROM SQL-SERVER TO ENGINEERING HOST B

Pinging 172.16.20.100 with 32 bytes of data:
Reply from 172.16.20.100: bytes=32 time<1ms TTL=127
Reply from 172.16.20.100: bytes=32 time<1ms TTL=127
Reply from 172.16.20.100: bytes=32 time<1ms TTL=127
Reply from 172.16.20.100: bytes=32 time<1ms TTL=127

Ping statistics for 172.16.20.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms


C:\Users\SQL-Server>tracert 172.16.20.100

Tracing route to ENGINEERING-PC [172.16.20.100]
over a maximum of 30 hops:

  1     2 ms     1 ms     1 ms  172.16.40.4    // DLS2
  2    <1 ms    <1 ms    <1 ms  ENGINEERING-PC [172.16.20.100]

Trace complete.

DLS2(config)#interface range fastethernet0/7-12
DLS2(config-if-range)#shutdown
DLS2(config-if-range)#
2511-TS#1
[Resuming connection 1 to dls1 ... ]

DLS1#
*Mar  1 01:25:58.826: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to down
*Mar  1 01:25:58.834: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/12, changed state to down
*Mar  1 01:25:58.842: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel3, changed state to down
*Mar  1 01:25:59.832: %LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to down
*Mar  1 01:25:59.857: %LINK-3-UPDOWN: Interface Port-channel3, changed state to down
*Mar  1 01:25:59.857: %LINK-3-UPDOWN: Interface FastEthernet0/12, changed state to down
*Mar  1 01:26:04.815: %HSRP-5-STATECHANGE: Vlan40 Grp 1 state Standby -> Active   // DLS1 PREEMPTS AND BECOME ACTIVE ROUTER FOR VLANs 30 AND 40
*Mar  1 01:26:06.509: %HSRP-5-STATECHANGE: Vlan30 Grp 1 state Standby -> Active 

DLS1#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   150  P Active   local           unknown         172.16.1.1
Vl10        1   150  P Active   local           unknown         172.16.10.1
Vl20        1   150  P Active   local           unknown         172.16.20.1
Vl30        1   100  P Active   local           unknown         172.16.30.1   
Vl40        1   100  P Active   local           unknown         172.16.40.1  


DLS2(config)#interface range fastethernet0/7-12
DLS2(config-if-range)#no shut

<OUTPUT TRUNCATED>


*Mar  1 01:28:45.255: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to up
*Mar  1 01:28:45.415: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel2, changed state to up
*Mar  1 01:28:45.591: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel3, changed state to up
*Mar  1 01:29:13.290: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up
*Mar  1 01:29:13.290: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
*Mar  1 01:29:13.290: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up
*Mar  1 01:29:13.290: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan30, changed state to up
*Mar  1 01:29:17.141: %HSRP-5-STATECHANGE: Vlan30 Grp 1 state Listen -> Active   // DLS2 PREEMPTS AND TAKES OVER THE ACTIVE ROUTER ROLE FOR VLANs 30 AND 40
*Mar  1 01:29:34.312: %HSRP-5-STATECHANGE: Vlan1 Grp 1 state Speak -> Standby
*Mar  1 01:29:34.312: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Speak -> Standby
*Mar  1 01:29:34.312: %HSRP-5-STATECHANGE: Vlan20 Grp 1 state Speak -> Standby

DLS2#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   100  P Standby  172.16.1.3      local           172.16.1.1
Vl10        1   100  P Standby  172.16.10.3     local           172.16.10.1
Vl20        1   100  P Standby  172.16.20.3     local           172.16.20.1
Vl30        1   150  P Active   local           172.16.30.3     172.16.30.1  
Vl40        1   150  P Active   local           172.16.40.3     172.16.40.1