Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About alfista16
02-13-2019
Stats
Member since
03-22-2018
24
Posts
10
Helpful
2
Solutions
12-14-2018
04:41 AM
Hi Marvin There is no IP address currently applied on the M1/1 interface, however we are in the middle of deploying Firepower on that site. "show module sfr detail" displayed the MAC address that was learnt by the switch. Thanks a lot.
... View more
12-14-2018
02:15 AM
Sorry if this was unclear before, but I have issued the command that you suggested. The ASA model is 5506, as described in the 1st question. To make this more clear, this is what is see when I execute your command: FW-01# show interface stats | in Mana|MAC MAC address 0000.1111a4dc, MTU 1500 MAC address 0000.1111.a4dd, MTU 1500 MAC address 0000.1111.a4de, MTU not set MAC address 0000.1111.a4df, MTU not set MAC address 0000.1111.a4e0, MTU not set MAC address 0000.1111.a4e1, MTU not set MAC address 0000.1111.a4e2, MTU not set MAC address 0000.1111.a4e3, MTU not set Interface Management1/1 "", is up, line protocol is up MAC address 0000.1111.a4db, MTU not set Now, on my switch, this is the MAC seen on the port connected with ASA's management1/1 port: 0000.1111.a4da That MAC does not appear anywhere in the Firewall. Any suggestions? Regards, George
... View more
12-13-2018
06:08 AM
Hello, Our ASA 5506 shows a MAC address for its Mgmt1/1 interface other than the one learnt by a neighbor switch. I tried to locate Management1/1 's MAC address by issuing the following commands on the Firewall : show interface | i Int|MAC show vers | i address The output of the above commands do not display the MAC address that the switch actually learns. The switch learns for the Firewall's Mgmt1/1 interface a MAC address of the same OUI, only the last hexadecimal differs. Any idea why this happens? Thank you.
... View more
Labels:
06-05-2018
09:43 AM
Those are the right answers indeed, according to a few sites I searched in.
- IOS-specific sounds like a great explanation on what concerns port security.
- The idea that trunk links are not supported at a speed of 10Mbps is one more thing that is mentioned in a blurry - up to misleading - way in Lammle's book. Unfortunately.
Thank you very much Joseph.
... View more
06-03-2018
10:06 AM
Hello,
Found this question out there and was curious about the answer:
Which three of these statements regarding 802.1Q trunking are correct? (Choose three) A. 802.1Q native VLAN frames are untagged by default.
B. 802.1Q trunking ports can also be secure ports.
C. 802.1Q trunks can use 10 Mb/s Ethernet interfaces.
D. 802.1Q trunks require full-duplex, point-to-point connectivity.
E. 802.1Q trunks should have native VLANs that are the same at both ends.
While testing in Cisco Packet Tracer and upon some research in google, it seems that trunk ports can support 10Mbps (in contrast to what is mentioned in Lammle's CCNA book) and they also support port-security.
Thus, the right answers could be four, rather than three (A,B,C,E).
What is your opinion here?
Thank you.
... View more
Labels:
05-24-2018
03:16 AM
I just ran into a very similar issue:
interface Vlan10 ip address 172.16.10.1 255.255.255.0 ip helper-address 192.168.100.1 end
I have configured on a VLAN interface ip helper-address 192.168.100.1 while on the same VLAN i have connected another rogue DHCP server with IP = 172.16.10.254.
When I connect a DHCP client (PC) on that VLAN, usually the rogue DHCP replies much faster than the time that the switch needs to act as a relay agent and generate a unicast DHCP Discover to the legitimate DHCP server 192.168.100.1. As a result, the PC gets an IP address on the 172.16.10.0 subnet.
What happens here is actually a race condition. The switch receives the DHCP DISCOVER, which is a broadcast message, and lets this broadcast flow to the ports belonging to the same VLAN, but at the same time, the switch generates a unicast DHCP DIscover message and sends it to the helper DHCP server, i.e. the switch acts as the relay agent. How much more functional would this be, if the switch prevented the DHCP Discover from being broadcasted to the same VLAN and just generated a unicast DHCP Discover to the helper DHCP?
... View more
05-23-2018
01:48 AM
As a result and after quite some research, there is not a solid way to "force" a switch learn all mac addresses of its connected hosts. The switch learns the MAC address after the host sends some L2 traffic. So, as an example, we should at least know that host's IP address and ping it, so that the switch learns its MAC through the host's echo reply.
Now, on my case where the show interface showed the port as "up/up" but no MAC address was learnt on that port:
It is the Wake-On-LAN (WoL) feature. WoL feature somewhat keeps the PC's network interface into sleep mode rather than powered off. A Windows PC was connected at that port and despite the fact that it was powered off, the WoL feature kept the physical Layer up (current running through the cable) so the interface showed as up/up at the switch.
Hope this might help for future reference.
Regards,
George
... View more
05-15-2018
11:02 AM
Julio,
That is an excellent finding and i will definitely keep that in mind. Thank you so much.
However, I am far away from reaching to the conclusion that the MACs are not learnt due to a 3850 bug.
So my question remains:
Let's assume that a host is not chatty at all and sends nothing but DHCP traffic every couple of hours.
If - in the meantime - I want to learn their MAC and "force" the host to send some traffic, so that the switch learns its MAC, how can I trigger that?
... View more
05-15-2018
05:43 AM
Hi Julio,
I would not say it is a bug yet. I have no idea what hosts are connected to those ports and I cannot tell for sure if they exchange any traffic. Given that the MAC address table is not learning anything, I would expect that they actually do not exchange any traffic at all. Also, I have not tried to reboot the switch yet. it is a 3850.
... View more
05-15-2018
05:14 AM
This has been discussed before, but i did not manage to find a solid solution .
Thing is that i just joined a company, and while some interfaces across various switches show as "up/up" (connected) the MAC address table is not learning anything there.
Unfortunately I have no idea what is connected on those ports, so i tried the following:
- Pinging from the switch the broadcast IP of the VLAN in which those ports belong
- DNS request to the broadcast IP of that vlan
- shut / no shut the port, in case this triggers the end device to send any traffic (gratuitous arp, dhcp discover, whatever)
Still unable to learn the MAC somehow.
Any ideas?
Thank you in advance,
George
... View more
Labels:
05-12-2018
04:37 AM
Thank you very much for confirming Georg.
By the way, how do you test switches in GNS3?
As far as I am aware, it only supports routers.
I assume you use the bridge command in some router?
Or maybe a router supporting switchport command?
Sorry for the silly question, I am kind of new at this whole thing.
... View more
05-12-2018
01:38 AM
Please find attached an image of the setup (image_bpdugrd.png) and the actual packet tracer file, which is renamed to STP.jpeg, so that the system allows me to upload it. Just rename "STP.jpg" to STP.pkt" and open it in Cisco Packet tracer. The setup on the left blocks one port, while the setup on the right (including bpduguard) creates a broadcast storm. I tested on real equipment and this is not what happens.
It is certainly a CPT bug.
... View more
05-08-2018
05:53 AM
Hello,
I am having a common triangle 3-switch topology (2960) eligible to loop, as in the attached image.
My first config includes switchport mode access for all involved ports and spanning-tree portfast default. When the top switch is connected and the loop "closes", despite the portfast command, STP takes action and blocks F0/2 from the bottom Switch2. This is expected, according to this article ( https://learningnetwork.cisco.com/blogs/vip-perspectives/2016/03/10/advanced-stp-features-portfast-bpdu-guard-and-bpdu-filter ) since portfast does not disable STP, it just forces an access port to enter to the FWD state instantly. Even with portfast, if a BPDU is detected, the port is set to BLK state.
Here comes the interesting part:
While in Cisco Packet tracer, when i enable bpduguard on all involved ports (conf t - - > interface range f0/1-3 - - > spanning-tree bpduguard enable) and then connect the top switch to the loop, the network literally collapses. All three switches consider themselves as STP root bridges, the ports are coloured dark green and PC0 can never ping PC1. Even more, all ports on all switches are showing to be in FWD state, while the sh int f0/1-2-3 command shows all interfaces as up-up!
Again, all ports are access ports, just configured them like that for testing purposes, to see what happens if i connect a switch to an access port with portfast and bpduguard.
My question:
Is this a Cisco Packet tracer bug or a real life scenario?
Thank you in advance,
George
... View more
Labels:
03-31-2018
12:57 AM
Hello everyone.
Thank you all for your contribution. Let me please share some findings after capturing traces on a 3850 L3 switch port. It will be more interesting to start with the "legacy" Option#2, i.e. a trunk port with native vlan 10 and allowed vlans 10 and 20:
Option#2 (trunk ports)
- The switch sends CDP to the IP Phone, tagged with default vlan 1. This is not a typo, again vlan 1. You may confirm this on Cisco's official 3850 documentation, here: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/vlan/configuration_guide/b_vlan_3se_3850_cg/b_vlan_3se_3850_cg_chapter_0110.html
"To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any individual VLAN trunk port by removing VLAN 1 from the allowed list. When you remove VLAN 1 from a trunk port, the interface continues to send and receive management traffic, for example, Cisco Discovery Protocol (CDP), Port Aggregation Protocol (PAgP), Link Aggregation Control Protocol (LACP), DTP, and VTP in VLAN 1."
With this config, I would not expect the IP Phones to learn their voice vlan via CDP, since they do not expect incoming tagged traffic on vlan 1.
- CDP includes various fields, among which a field "advertising" its Native VLAN 10. There is no field for the allowed vlan 20. Again, those CDP frames are tagged with VLAN=1, and thus should never actually reach the IP Phone, who is vlan-unaware when first connected to a switch port.
- The switch also sends STP messges, both tagged (for allowed vlan 20) and untagged (for native vlan 10)
Option#1 (access vlan / voice vlan, a.k.a Multi VLAN Access Port - MVAP, a.k.a "mini-trunk")
- The switch sends CDP frames untagged, as expected (we are having an access port here)
- CDP "advertises" its Native vlan 10 and its VoIP vlan 20. In this scenario, the IP phones (vlan - unaware as they are) could very well be provisioned via CDP, i.e. they could "learn" the voice vlan via CDP, assuming they support CDP of course.
- The switch also sends STP BPDUs, both untagged (for access vlan 10) and also tagged for voice vlan 20.
Some additional notes:
1. I have seen configs where people enter the "switchport access vlan 10" and "switchport voice vlan 20" commands on a trunk port (Option#1), i.e. a port that explicitly includes the "switchport mode trunk":
- The "switchport access vlan 10" command does not affect the trunk port anyhow.
- The "switchport voice vlan 20" command, if added on a trunk port, advertises via CDP the VoIP vlan 20. This would make sense if the CDP messages were actually received by the IP Phones. But again, when in trunk mode with native vlan=10, the CDP frames are generated by the switch tagged on default vlan=1.. Thus, they never reach the IP phone, so i am wondering why anyone would use the "switch voice vlan 20" command on a trunk port.
- As a conclusion, in order for the IP Phone to learn its voice vlan via CDP, the only approach is Option#1 - access mode with voice vlan
Hope this helps.
Please feel free to comment.
Regards,
George
... View more
03-26-2018
06:39 AM
It is interesting indeed. But quite confusing at the same time, for a guy who is currently studying CCNA theory, where access ports are strictly supposed to send and receive untagged traffic only! :) (that's me)
Especially while at the same time Cisco officially declares in an older article that access vlan (native vlan for the article's scope) sends untagged traffic and only the voice vlan tags the traffic. See "Multi-VLAN Access Ports" here: http://www.ciscopress.com/articles/article.asp?p=1315434&seqNum=4:
"Data packets between the multiservice access switch and the PC or workstation are on the native VLAN. All packets going out on the native VLAN of an IEEE 802.1Q port are sent untagged by the access switch. The PC or workstation connected to the IP phone usually sends untagged packets.
Voice packets are tagged by the IP phone based on the CDP information from the access switch."
... View more
Created by
alfista16
in Data Center Switches
02-06-2019
02-06-2019
ello,We have a Cisco Nexus 6000 switch and have been using Netflow
commands on it.Those commands can...
12-14-2018
Hi Marvin There is no IP address currently applied on the M1/1
interface, however we are in the midd...
12-14-2018
Sorry if this was unclear before, but I have issued the command that you
suggested.The ASA model is ...
12-13-2018
Hello, Our ASA 5506 shows a MAC address for its Mgmt1/1 interface other
than the one learnt by a nei...
06-05-2018
Those are the right answers indeed, according to a few sites I searched
in. - IOS-specific sounds li...
06-03-2018
Hello, Found this question out there and was curious about the answer:
Which three of these statemen...
05-24-2018
I just ran into a very similar issue: interface Vlan10 ip address
172.16.10.1 255.255.255.0 ip helpe...
05-23-2018
As a result and after quite some research, there is not a solid way to
"force" a switch learn all ma...
05-15-2018
Julio, That is an excellent finding and i will definitely keep that in
mind. Thank you so much. Howe...
05-15-2018
Hi Julio, I would not say it is a bug yet. I have no idea what hosts are
connected to those ports an...
05-15-2018
This has been discussed before, but i did not manage to find a solid
solution . Thing is that i just...
Public Statistics
| Date Registered | 03-22-2018 10:53 AM |
| Date Last Visited | 02-13-2019 05:22 AM |
| Total Messages Posted | 24 |
| Total Helpful Votes Received | 10 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
