Lesson 18 - VTP and VLAN Quiz
Lesson 18 - VTP and VLAN Quiz
The last lesson presented the gory details behind inter-VLAN routing. Now, I would like you to play a little game with me. A simple quiz will check your understanding of both access and trunk ports. Have fun!
Study the first topology carefully (Pic. 1) and answer the question 1.
Question1: When PC1 is sending broadcast frames (destination MAC address: FFFF.FFFF.FFFF), which computers are going to receive them?
NOTICE!
All switch-to-switch connections in Pic.1 are ACCESS ports.
The answer to question 1 can be found at the bottom of this post. But try not to cheat. Check the answer after you have provided yours;).
Study the second topology carefully (Pic. 2) and answer the question 2.
Question2: When PC1 is sending broadcast frames (destination MAC address: FFFF.FFFF.FFFF), which computers are going to receive them?
The answer to question 1 can be found at the bottom of this post. But try not to cheat. Check the answer after you have provided yours;).
Now, I can start our last lesson related to VLANs. It's about Cisco Vlan Trunking Protocol.
Vlan Trunking Protocol (VTP)
Cisco have created this protocol to facilitate automatic VLAN distribution between switches that use trunking connection. There is similar protocol called GVRP that is industry standard solution. At first glance, it looks like it works like VTP but it has some significant differences. For more details use google to learn it.
What Does VTP Do?
VTP is turned on by default but there are some things that need to be configured for this to work. The idea is very simple: instead of typing in all the VLANs end-to-end, (on all switches individually), you can configure VLANs on one switch only, and the same configuration will be propagated to all switches in the network (VTP domain to be more accurate). By 'the same configuration', I mean that VLAN database is synchronized (exchanged) between all the switches. In other words, VLAN numbers and their names are exchanged. The port-to-VLAN assignments are NOT exchanged. Consider this example:
The above configuration creates 'VLAN 4' and assings the name of 'IT_Dept' to it. In a split of a second, the same VLAN 4 named IT_Dept is populated into the database of all switches in the network (VTP domain).
How Does VTP Work?
As you recall from the lesson 16, VLAN configuration typically involves three steps:
Study the first topology carefully (Pic. 1) and answer the question 1.
Question1: When PC1 is sending broadcast frames (destination MAC address: FFFF.FFFF.FFFF), which computers are going to receive them?
NOTICE!
All switch-to-switch connections in Pic.1 are ACCESS ports.
Pic. 1 - Switches are connected using ACCESS mode (NOT a trunk mode).
Icons designed by: Andrzej Szoblik - http://www.newo.pl
Study the second topology carefully (Pic. 2) and answer the question 2.
Pic. 2 - Switches are connected using TRUNKING mode.
Icons designed by: Andrzej Szoblik - http://www.newo.pl
Question2: When PC1 is sending broadcast frames (destination MAC address: FFFF.FFFF.FFFF), which computers are going to receive them?
The answer to question 1 can be found at the bottom of this post. But try not to cheat. Check the answer after you have provided yours;).
Now, I can start our last lesson related to VLANs. It's about Cisco Vlan Trunking Protocol.
Vlan Trunking Protocol (VTP)
Cisco have created this protocol to facilitate automatic VLAN distribution between switches that use trunking connection. There is similar protocol called GVRP that is industry standard solution. At first glance, it looks like it works like VTP but it has some significant differences. For more details use google to learn it.
What Does VTP Do?
VTP is turned on by default but there are some things that need to be configured for this to work. The idea is very simple: instead of typing in all the VLANs end-to-end, (on all switches individually), you can configure VLANs on one switch only, and the same configuration will be propagated to all switches in the network (VTP domain to be more accurate). By 'the same configuration', I mean that VLAN database is synchronized (exchanged) between all the switches. In other words, VLAN numbers and their names are exchanged. The port-to-VLAN assignments are NOT exchanged. Consider this example:
SW1(config)#vlan 4
SW1(config-vlan)#name IT_Dept
SW1(config-vlan)#end
SW1#
The above configuration creates 'VLAN 4' and assings the name of 'IT_Dept' to it. In a split of a second, the same VLAN 4 named IT_Dept is populated into the database of all switches in the network (VTP domain).
How Does VTP Work?
As you recall from the lesson 16, VLAN configuration typically involves three steps:
- Configuring VLAN numbers in the 'global config' mode. Optionally, you can also give those VLAN unique names.
- Assigning interfaces to VLANs (access mode). Optionally, you can map MAC addresses to VLANs (access dynamic mode). But in order to use this method VMPS server is required.
- Configuring trunking connections between the switches (if the same VLANs are applied on all switches - aka end-to-end VLANs).
Even though VTP is turned on by default, a few things must be configured for VLANs to be distributed among switches.
A Cisco switch can be configured in one of the three VTP modes:
VTP Pruning
Vlan Trunking Protocol offers one more interesting feature called: PRUNING. It allows the switches to communicate over trunks which VLAN traffic should not be sent down from the upstream switch. Consider the Pic. 3 below:
If SW1 is sending broadcast from VLAN 10, the frames will be flooded out of all active ports in VLAN 10 as well as the trunking ports. Recall, that the ports in the trunking mode are multi VLAN ports allowing ALL of them by default (VLANs 1-4094). SW2 receives the broadcast from VLAN 10, on its interface F0/13, but then realizes, that currently there are NO members of VLAN 10 connected to any of its ports.
When VTP Pruning is enabled, SW2 will inform SW1 (pic. 3), that it does not want to receive traffic from VLAN 10. Should you connect at least one host to VLAN 10 to SW2 though, it will send another request, that VLAN 10 be on longer pruned on SW1 trunk port F0/13. It happens automatically without any further configuration.
Of course, if you do not want to use VTP, you do not have to. You can configure VLANs manually on all switches of yours. Also, you can prune the traffic on trunk ports manually. The command is shown below:
The above configuration will allow only VLANs 10,15 and 22 to cross the trunk f0/13 (command in blue).
VTP Configuration
In order to illustrate configuration steps, I am going to use the same topology as in a few previous posts.
The default configuration looks like the output below: 'show vtp status'.
In my topology I am going to use the secure way of introducing VTP protocol FOR THE FIRST TIME!!!
Step 1
Clear the revision number on all the switches by typing the following in the 'global config' mode:
Step 2
Initially, I am going to use SW1 as the VTP server, SW2 and SW3 as the VTP clients.
Step 3
Configure VTP domain on SW1 (here domain name = CCNA).
NOTICE!
SW1 is going to propagate the domain name (CCNA) to all other switches. They will learn it on their trunk ports. Trunk ports were configured in my previous lab.
Step 4
Apply the same password (MD5 algorithm is used), on all switches, so if somebody plugs in a new switch, that new switch without this password is not going to change the VLANs configured so far. Here the password used is: Secret123
Step 5 (Optional)
Enable VTP pruning to save bandwidth by not transmitting the broadcast traffic towards switches that have no members of VLANs defined in their databases. If you configure this on SW1 (server), this will enable pruning on all switches in our VTP domain.
If you want to make other switches servers, you can change their mode of operation now.
This way we have introduced VTP domain and now you can add, remove, delete, modify VLANs on one switch (VTP server), and all these changes will be propagated to all of switches (VTP servers or clients) in your domain CCNA.
I will have two videos recorded soon. The first one will provide you with explanation to the answers of my quiz presented above. The second one will show you how VTP can cause serious problems in your network if you do not take the right precautions.
And now, let me give you the answers to the quiz questions.
The answer to question 1 (pic. 1):
The broadcast frames sent by PC1 will be sent to PC2 and PC5.
Explanation:
The answer to question 2 (pic. 2):
The broadcast frames sent by PC1 will be sent to PC3 and PC6.
In my next post I will talk about Spanning-Tree Protocol.
- Switches must belong to the same VTP domain (the same domain namemust be configured on the switches to synchronize their VLAN databases).
- If, optionally, switches use domain password, this password must be identical on all switches in the VTP domain.
- The connections between switches must be in the 'trunking mode' (it is Vlan TRUNKING Protocol after all).
- VTP version must be the same on all switches (there are VTP 1,2 or 3 version).
A Cisco switch can be configured in one of the three VTP modes:
- VTP Server (default mode) - this mode allow you to add, remove, delete, modify VLANs to a database. All is saved in NVRAM (Non-Volatile RAM memory - the one that does not lose its content on power-down).
- VTP Client - in this mode you CANNOT create VLANs in the local database. The only way for the VTP client to learn VLANs is to send a request advertisement. Server respond to this, by sending information about VLANs and their names used in the domain (subset advertisement).
- VTP Transparent - is a similar to a server mode of operation. The major difference is that, the transparent mode does NOT participate in the VTP domain. This means that the transparent mode does NOT synchronize its database with any other switch (a local database of VLANs), and it does NOT learn VLANs propagated by a VTP server. Transparent mode WILL forward VTP messages between other switches over trunk ports.
VTP server sends a special VTP frame every 5 minutes out of all trunking ports. This message is the summary advertisement. In this message, among other pieces of information, it inlcudes:
If there is a topology change (VLAN added, removed, name modified etc.), VTP server sends new summary advertisement IMMEDIATELY with the revision number incremented. All other switches, upon receiving this message, will compare their own VTP domain name, protocol version, MD5 digest (if used), and the revision number. If the 'revision number' in the incoming message is HIGHER than the last seen, they send an advertisement request message towards the server. The VTP server responds with one or more subset advertisement describing all the VLANs found in its database. This new information is going to replace the old one on all other VTP client or server switches.
- VTP domain name
- MD5 digest (if password is used in VTP domain)
- Revision number
If there is a topology change (VLAN added, removed, name modified etc.), VTP server sends new summary advertisement IMMEDIATELY with the revision number incremented. All other switches, upon receiving this message, will compare their own VTP domain name, protocol version, MD5 digest (if used), and the revision number. If the 'revision number' in the incoming message is HIGHER than the last seen, they send an advertisement request message towards the server. The VTP server responds with one or more subset advertisement describing all the VLANs found in its database. This new information is going to replace the old one on all other VTP client or server switches.
VTP Pruning
Vlan Trunking Protocol offers one more interesting feature called: PRUNING. It allows the switches to communicate over trunks which VLAN traffic should not be sent down from the upstream switch. Consider the Pic. 3 below:
Pic. 3 - VTP VLAN Pruning Example.
Icons designed by: Andrzej Szoblik - http://www.newo.pl
If SW1 is sending broadcast from VLAN 10, the frames will be flooded out of all active ports in VLAN 10 as well as the trunking ports. Recall, that the ports in the trunking mode are multi VLAN ports allowing ALL of them by default (VLANs 1-4094). SW2 receives the broadcast from VLAN 10, on its interface F0/13, but then realizes, that currently there are NO members of VLAN 10 connected to any of its ports.
When VTP Pruning is enabled, SW2 will inform SW1 (pic. 3), that it does not want to receive traffic from VLAN 10. Should you connect at least one host to VLAN 10 to SW2 though, it will send another request, that VLAN 10 be on longer pruned on SW1 trunk port F0/13. It happens automatically without any further configuration.
Of course, if you do not want to use VTP, you do not have to. You can configure VLANs manually on all switches of yours. Also, you can prune the traffic on trunk ports manually. The command is shown below:
SW1#conf t
SW1(config)#interface f0/13
SW1(config-if)#switchport encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW1(config-if)#switchport trunk allowed vlan 10,15,22
SW1(config-if)#
The above configuration will allow only VLANs 10,15 and 22 to cross the trunk f0/13 (command in blue).
VTP Configuration
In order to illustrate configuration steps, I am going to use the same topology as in a few previous posts.
Pic. 4 - Topology Diagram
Icons designed by: Andrzej Szoblik - http://www.newo.pl
The default configuration looks like the output below: 'show vtp status'.
Pic. 5 - Default VTP settings.
Well, in my output, the only setting that is not the default is the 'Number of existing VLANs'. I have one VLAN configured (VLAN 500), which is my management VLAN allowing me access the switch remotely.
As you can notice, the VTP mode is server, and the domain name is empty (no domain name configured). So, the switch allows you to configure VLANs but the database is not going to be propagate to other switches. Below are the steps of introducing VTP protocol for the first time.
NOTICE!
The command: vtp mode transparent in the 'global config' mode will clear the revision number back to '0'.
In my topology I am going to use the secure way of introducing VTP protocol FOR THE FIRST TIME!!!
Step 1
Clear the revision number on all the switches by typing the following in the 'global config' mode:
switch(config)#vtp mode transparent
switch(config)#
Step 2
Initially, I am going to use SW1 as the VTP server, SW2 and SW3 as the VTP clients.
SW1(config)#vtp mode server
SW1(config)#
SW2(config)#vtp mode client
SW2(config)#
SW3(config)#vtp mode client
SW3(config)#
Step 3
Configure VTP domain on SW1 (here domain name = CCNA).
SW1(config)#vtp domain CCNA
NOTICE!
SW1 is going to propagate the domain name (CCNA) to all other switches. They will learn it on their trunk ports. Trunk ports were configured in my previous lab.
Step 4
Apply the same password (MD5 algorithm is used), on all switches, so if somebody plugs in a new switch, that new switch without this password is not going to change the VLANs configured so far. Here the password used is: Secret123
SW1(config)#vtp password Secret123
SW1(config)#
SW2(config)#vtp password Secret123
SW2(config)#
SW3(config)#vtp password Secret123
SW3(config)#
Step 5 (Optional)
Enable VTP pruning to save bandwidth by not transmitting the broadcast traffic towards switches that have no members of VLANs defined in their databases. If you configure this on SW1 (server), this will enable pruning on all switches in our VTP domain.
SW1(config)#vtp pruning
If you want to make other switches servers, you can change their mode of operation now.
This way we have introduced VTP domain and now you can add, remove, delete, modify VLANs on one switch (VTP server), and all these changes will be propagated to all of switches (VTP servers or clients) in your domain CCNA.
I will have two videos recorded soon. The first one will provide you with explanation to the answers of my quiz presented above. The second one will show you how VTP can cause serious problems in your network if you do not take the right precautions.
And now, let me give you the answers to the quiz questions.
The answer to question 1 (pic. 1):
The broadcast frames sent by PC1 will be sent to PC2 and PC5.
Explanation:
1. If switch connections are not using trunks, the sending switch will flood broadcast out of all ports, except it was received on, as long as they belong to the same VLAN. The sending port does not include a VLAN tag (number) since only TRUNK ports attach extra 4 bytes with sending VLAN id (tag).
2. The receiving switchport is going to accept frame without the TAG because it is an access port (not trunk). It assumes that the frame belongs to a VLAN number is was configured to use locally (there is no difference connecting a computer to a port of a switch, or other device, printer, router or switch). It follows what the first switch did. It interprets the incoming frame as a frame that belongs to a VLAN it was configured as (switchport access vlan #). Since the frame destination address is broadcast, it floods it out of all ports that belong to the same VLAN number as the receiving port.
3. The next switch receiving this frame will follow step 2.
Best ways is to experiment: two switches, and three computers (1 sender on SW1 and 2receivers on SW2) with wireshark enabled. ;)
The answer to question 2 (pic. 2):
The broadcast frames sent by PC1 will be sent to PC3 and PC6.
In my next post I will talk about Spanning-Tree Protocol.
Comments
Post a Comment