Overview
A switch is a Layer 2 network device that acts as the concentration point for the connection of workstations, servers, routers, hubs, and other switches.
A hub is an older type of concentration device that also provides multiple ports. However, hubs are inferior to switches because all devices connected to a hub share the bandwidth and the same collision domain. Another drawback to hubs is that they only operate in half-duplex mode. In half-duplex mode, hubs can only send or receive data at any given time, but they cannot do both at the same time. Switches can operate in full-duplex mode, which means they can send and receive data simultaneously.
Switches are multi-port bridges. Switches are the current standard technology for Ethernet LANs that utilize a star topology. A switch provides many dedicated, point-to-point virtual circuits between connected network devices, so collisions are not likely to occur.
Because of the dominant role of switches in modern networks, the ability to understand and configure switches is essential for network support.
New switches have a preset configuration with factory defaults. This configuration rarely meets the needs of network administrators. Switches can be configured and managed from a command-line interface (CLI). Network devices can also be configured and managed through a web based interface and a browser.
Network administrators must be familiar with all tasks associated with the management of networks with switches. Some of these tasks include maintenance of the switch and its IOS. Other tasks include management of the interfaces and tables for optimal, reliable, and secure operation. Basic switch configuration, IOS upgrades, and password recovery are essential network administrator skills.
This module covers some of the objectives for the CCNA 640-801 and ICND 640-811 exams.
Students who complete this module should be able to perform the following tasks:
• Identify the major components of a Catalyst switch
• Monitor switch activity and status with the use of LED indicators
• Examine the switch bootup output with the use of HyperTerminal
• Use the help features of the command-line interface
• List the major switch command modes
• Verify the default settings of a Catalyst switch
• Set an IP address and default gateway for the switch to allow connection and management over a network
• View the switch settings with a Web browser
• Configure interfaces for speed and duplex operation
• Examine and manage the switch MAC address table
• Configure port security
• Manage configuration files and IOS images
• Perform password recovery on a switch
• Upgrade the IOS of a switch
6.1 Starting the Switch
6.1.1 Physical startup of the Catalyst switch
This page will explain the features, functions, and startup of switches.
Switches are dedicated, specialized computers that contain a central processing unit (CPU), random access memory (RAM), and an operating system. As shown in Figure , switches usually have several ports that hosts can connect to, as well as specialized ports for the purpose of management. Switches can be managed and the configuration can be viewed and changed through the console port.
Switches typically have no power switch to turn them on and off. They simply connect or disconnect from a power source.
Several switches from the Cisco Catalyst 2950 series are shown in Figure . There are 12-port, 24-port, and 48-port models. The top two switches in Figure are fixed configuration symmetrical switches with all ports being FastEthernet or 10/100. The next three switches are asymmetrical models with two fixed fiber or copper Gigabit Ethernet ports. The bottom four switches are asymmetrical models with modular Gigabit Interface Converter (GBIC) slots which can accommodate a variety of copper and fiber media options.
The next page will discuss LED indicators on a switch.
6.1.2 Switch LED indicators
The front panel of a switch has several lights to help monitor system activity and performance. These lights are called light-emitting diodes (LEDs). This page will discuss the LEDs on the front of a switch:
• System LED
• Remote Power Supply (RPS) LED
• Port Mode LEDs
• Port Status LEDs
The System LED shows whether the system is receiving power and functioning correctly.
The RPS LED indicates whether or not the remote power supply is in use.
The Mode LEDs indicate the state of the Mode button. The modes are used to determine how the Port Status LEDs are interpreted. To select or change the port mode, press the Mode button repeatedly until the Mode LEDs indicate the desired mode.
Figure describes the Port Status LED colors as these are dependent on the value of the Mode LEDs.
The next page will explain how LEDs are used to verify the functionality of a switch.
6.1.3 Verifying port LEDs during switch POST
This page will explain how LEDs can be used to determine if a switch works properly and has established a link with its target.
Once the power cable is connected, the switch initiates a series of tests called the power-on self test (POST). POST runs automatically to verify that the switch functions correctly. The System LED indicates the success or failure of POST. If the System LED is off but the switch is plugged in, then POST is running. If the System LED is green, then POST was successful. If the System LED is amber, then POST failed. POST failure is considered to be a fatal error. Reliable operation of the switch should not be expected if POST fails.
The Port Status LEDs also change during POST. The Port Status LEDs turn amber for about 30 seconds as the switch discovers the network topology and searches for loops. If the Port Status LEDs turn green, the switch has established a link between the port and a target, such as a computer. If the Port Status LEDs turn off, the switch has determined that nothing is plugged into the port.
The next page will teach students how to establish a communication session with a switch.
6.1.4 Viewing initial bootup output from the switch
This page will explain how HyperTerminal can be used to check and configure a switch.
In order to configure or check the status of a switch, connect a computer to the switch in order to establish a communication session. Use a rollover cable to connect the console port on the back of the switch to a COM port on the back of the computer.
Start HyperTerminal on the computer. A dialog window will be displayed. The connection must first be named when initially configuring the HyperTerminal communication with the switch. Select the COM port to which the switch is connected from the pull-down menu, and click the OK button. A second dialog window will be displayed. Set up the parameters as shown in Figure , and click the OK button.
Plug the switch into a wall outlet. The initial bootup output from the switch should be displayed on the HyperTerminal screen. This output shows information about the switch, details about POST status, and data about the switch hardware.
After the switch has booted and completed POST, prompts for the System Configuration dialog are presented. The switch may be configured manually with or without the assistance of the System Configuration dialog. The System Configuration dialog on the switch is simpler than that on a router.
The next page will explain how the help command is used in Cisco switches.
6.1.5 Examining help in the switch CLI
This page will explain how the help command is used in the CLI of Cisco switches.
The CLI for Cisco switches is very similar to the CLI for Cisco routers.
Enter a question mark (?) to issue the help command. When this command is entered at the system prompt, a list of commands available for the current command mode is displayed.
The help command is very flexible. To obtain a list of commands that begin with a particular character sequence, enter those characters followed immediately by the question mark (?). Do not enter a space before the question mark. This form of help is called word help, because it completes a word.
To list keywords or arguments that are associated with a particular command, enter one or more words associated with the command, followed by a space and then a question mark (?). This form of help is called command syntax help, because it provides applicable keywords or arguments based on a partial command.
The Interactive Media Activity will help students understand how switches reduce the size of collision domains.
The next page will discuss switch command modes.
6.1.6 Switch command modes
This page will discuss two switch command modes. The default mode is User EXEC mode. The User EXEC mode is recognized by its prompt, which ends in a greater-than character (>). The commands available in User EXEC mode are limited to those that change terminal settings, perform basic tests, and display system information. Figure describes the show commands that are available in User EXEC mode.
The enable command is used to enter Privileged EXEC mode from User EXEC mode. Privileged EXEC mode is also recognized by its prompt, which ends in a pound-sign character (#). The Privileged EXEC mode command set includes the configure command as well as all commands from the User EXEC mode. The configure command allows other command modes to be accessed. Because these modes are used to configure the switch, access to Privileged EXEC mode should be password protected to prevent unauthorized use. If a password is set, users are prompted to enter the password to gain access to Privileged EXEC mode. The password does not appear on the screen, and is case sensitive.
This page concludes this lesson. The next lesson will explain how a switch is configured. The next page will discuss the default configuration.
6.2 Configuring the Switch
6.2.1 Verifying the Catalyst switch default configuration
This page will teach students about the default configuration of a switch and how to verify it.
When powered up for the first time, a switch has default data in the running configuration file. The default hostname is Switch. No passwords are set on the console or virtual terminal (vty) lines.
A switch may be given an IP address for management purposes. This is configured on the virtual interface, VLAN 1. By default, the switch has no IP address.
The switch ports or interfaces are set to auto mode , and all switch ports are in VLAN 1. VLAN 1 is known as the default management VLAN.
The flash directory by default, has a file that contains the IOS image, a file called env_vars, and a sub-directory called html. After the switch is configured, the flash directory will contain a file called config.text as well as a VLAN database. As seen in Figure , the flash directory does not contain a config.text file or a VLAN database file called vlan.dat.
The IOS version and the configuration register settings can be verified with the show version command.
In this default state, the switch has one broadcast domain and the CLI can be used to manage and configure the switch through the console port. The Spanning-Tree Protocol is also enabled, and allows the bridge to construct a loop-free topology across an extended LAN.
For small networks, the default configuration may be sufficient. The benefits of better performance with microsegmentation are obtained immediately.
The Lab Activities will allow students to check the default configurations of two Cisco 2900 series switches.
The next page will explain how a switch is configured.
6.2.2 Configuring the Catalyst switch
This page will teach students how to configure a switch.
A switch may be preconfigured and only passwords may need to be entered for the User EXEC or Privileged EXEC modes. Switch configuration mode is entered from Privileged EXEC mode.
In the CLI, the default Privileged EXEC mode prompt is Switch#. In User EXEC mode the prompt is Switch>.
The following steps will ensure that a new configuration will completely overwrite the current configuration:
• To remove the current VLAN information, delete the VLAN database file called vlan.dat from the flash directory
• Erase the back up configuration file called startup-config
• Restart the switch with the reload command
Security, documentation, and management are important for every network device.
A switch should be given a hostname, and passwords should be set on the console and vty lines.
To allow the switch to be accessible by Telnet and other TCP/IP applications, IP addresses and a default gateway should be set. By default, VLAN 1 is the management VLAN. In a switch-based network, all network devices should be in the management VLAN. This allows a single management workstation to access, configure, and manage all the network devices.
The Fast Ethernet switch ports default to auto-speed and auto-duplex. This allows the interfaces to negotiate these settings. Network administrators can manually configure the interface speed and duplex values if necessary.
Some network devices can provide a web-based interface for configuration and management purposes. Once a switch is configured with an IP address and gateway, it can be accessed in this way. A web browser can access this service using the IP address and port 80, the default port for http. The HTTP service can be turned on or off, and the port address for the service can be chosen.
Any additional software such as an applet can be downloaded to the browser from the switch. Also, the switch can be managed by a browser based graphical user interface (GUI).
The Lab Activities will help students become more familiar with the basic configuration of a switch.
The next page will discuss MAC address tables.
6.2.3 Managing the MAC address table
This page will explain how switches create and manage MAC address tables.
Switches examine the source address of frames that are received on the ports to learn the MAC address of PCs or workstations that are connected to it. These learned MAC addresses are then recorded in a MAC address table. Frames that have a destination MAC address that has been recorded in the table can be switched out to the correct interface.
The show mac-address-table command can be entered in the Privileged EXEC mode to examine the addresses that a switch has learned.
A switch dynamically learns and maintains thousands of MAC addresses. To preserve memory and for optimal operation of the switch, learned entries may be discarded from the MAC address table. Machines may have been removed from a port, turned off, or moved to another port on the same switch or a different switch. This can cause confusion when frames are forwarded. For all these reasons, if no frames are seen with a previously learned address, the MAC address entry is automatically discarded or aged out after 300 seconds.
Rather than wait for a dynamic entry to age out, network administrators can use the clear mac-address-table command in Privileged EXEC mode. MAC address entries configured by network administrators can also be removed with this command. This method to clear table entries ensures that invalid addresses are removed immediately.
The Lab Activities will teach students how to create a basic switch configuration and manage the MAC address table.
The next page will discuss static MAC addresses.
6.2.4 Configuring static MAC addresses
This page will explain how static MAC addresses are configured on a Catalyst 2900 switch.
A MAC address can be permanently assigned to an interface. The following are reasons to assign a permanent MAC address to an interface:
• The MAC address will not be aged out automatically by the switch.
• A specific server or user workstation must be attached to the port and the MAC address is known.
• Security is enhanced.
The following command can be used to configure a static MAC address for a switch:
Switch(config)#mac-address-table static
The following command can be used to remove a static MAC address for a switch:
Switch(config)#no mac-address-table static
In the Lab Activities, students will configure static MAC addresses.
6.2.5 Configuring port security
This page will explain why port security is important and how it is configured on a Catalyst 2950 switch.
Network security is an important responsibility for network administrators. Access layer switch ports are accessible through the structured cabling at wall outlets. Anyone can plug in a PC or laptop into one of these outlets. This is a potential entry point to the network by unauthorized users. Switches provide a feature called port security. It is possible to limit the number of addresses that can be learned on an interface. The switch can be configured to take an action if this is exceeded. Secure MAC addresses can be configured statically. However, it is a complex task to configure secure MAC addresses statically, and is usually prone to error.
An alternative approach is to set port security on a switch interface. The number of MAC addresses per port can be limited to 1. The first address dynamically learned by the switch becomes the secure address.
To reverse port security on an interface use the no form of the command.
The command show port security can be used to verify port security status.
The Lab Activities will show students how to configure port security on a switch.
The next page will discuss some other switch configurations.
6.2.6 Executing adds, moves, and changes
This page will discuss some items that should be configured before a switch is added to a network.
The following are parameters that should be configured on a new switch that is added to a network:
• Switch name
• IP address for the switch in the management VLAN
• A default gateway
• Line passwords
When a host is moved from one port or switch to another, configurations that can cause unexpected behavior should be removed. The switch can then be reconfigured to reflect the changes.
The Lab Activities will teach students how to add, move, and change MAC addresses on a switch.
The next page will discuss the backup of switch configuration files.
6.2.7 Managing switch operating system file
This page will teach students how to document and maintain the operational configuration files for network devices.
Network administrators should document and maintain the operational configuration files for network devices. The most current running-configuration file should be backed up on a server or disk. This is not only essential documentation, but is very useful if a configuration needs to be restored.
The IOS should also be backed up to a local server. The IOS can then be reloaded to flash memory if needed.
The Lab Activities will show students how to create, verify, back up, and then restore a basic switch configuration.
The next page will discuss password recovery.
6.2.8 1900/2950 password recovery
This page will discuss the importance of passwords and explain how they are recovered.
For security and management purposes, passwords must be set on the console and vty lines. An enable password and an enable secret password must also be set. These practices help ensure that only authorized users have access to the User and Privileged EXEC modes of the switch.
There will be circumstances where physical access to the switch can be achieved, but access to the User or Privileged EXEC mode cannot be gained because the passwords are not known or have been forgotten.
In these circumstances, a password recovery procedure must be followed.
The Lab Activities will show students how to recover a password on a Catalyst 2900 series switch.
6.2.9 1900/2950 firmware upgrade
This page will explain the purpose of IOS and firmware upgrades and how they are performed.
IOS and firmware images are periodically released with bugs fixes, new features, and performance improvements. If the network can be made more secure, or can operate more efficiently with a new version of the IOS, then the IOS should be upgraded.
To upgrade the IOS, download a copy of the new image to a local server from the Cisco Connection Online (CCO) Software Center.
The Lab Activities will show students how to upgrade the firmware of a switch.
This page concludes this lesson. The next page will summarize the main points from this module.
Summary
This page summarizes the topics discussed in this module.
Switches are similar to routers. They have basic computer components including a CPU, RAM, and an operating system. There are several ports that are used to connect hosts and for management. LEDs on the front of the switch show the system status, RPS, port mode, and port status. When powered on, a switch performs POST automatically to verify that the switch functions correctly. HyperTerminal can be used to configure or check the status of a switch.
Another similarity to Cisco routers is the CLI. Enter a question mark (?) to access help. A list of available commands will display. Switches provide word help and command syntax help.
Switches and routers have the same command modes. User EXEC is the default and is indicated by the greater-than character (>). The enable command changes User EXEC to Privileged EXEC as indicated by the pound sign (#). Access to Privileged EXEC mode should be password protected to prevent unauthorized use. The configure command allows other command modes to be accessed.
Default data is provided when the switch is powered up for the first time. For management purposes, a switch is assigned an IP address. Use the show version command to verify the IOS version and the configuration register settings.
Once a switch is configured with an IP address and gateway, it can be accessed through a web-based interface. This allows for the configuration and management of the switch. This service can be accessed through a web browser with the IP address and port 80, the default port for http.
A switch dynamically learns and maintains thousands of MAC addresses. If frames with a previously learned address are not received, the MAC address entry is automatically discarded or aged out after 300 seconds. The command clear mac-address-table entered in the Privileged EXEC mode can be used to manually clear address tables.
A permanent MAC address assigned to an interface ensures that the MAC address will not be aged out automatically by the switch and to enhance security. The command mac-address-table static
The switch name, IP address, default gateway, and line passwords should be configured on a new switch that is added to a network. When a host is moved from one port or switched to another, configurations that can cause unexpected behavior should be removed. Documentation should be maintained for the current configuration and backups to the server or a disk should be performed periodically.
No comments:
Post a Comment