Router and Switch Configuration Basic and step by step configurations By Mohammad Zameer Ahmadzai

Transcription

1 Router and Switch Configuration Basic and step by step configurations By Mohammad Zameer Ahmadzai ITCK NOC-MZ Ahmadzai 1

2 Basic Router Configuration The initial configuration of an IOS device involves configuring a device name and then the passwords that are used to control access to the various functions of the device. A device should be given a unique name as one of the first configuration tasks. This task is accomplished in global configuration mode with the following command: Router(config)#hostname [name] ITCK NOC-MZ Ahmadzai 2

3 Continued Once a hostname is configured on a device, the next configuration step should be configuring passwords to prevent access to the device by unauthorized individuals. The enable password and enable secret commands are used to restrict access to the privileged EXEC mode, preventing unauthorized users from making configuration changes to the router. The following commands are used to set the passwords: Router(config)#enable password [password ] Router(config)#enable secret [password ] ITCK NOC-MZ Ahmadzai 3

4 Continued The difference between the enable password and the enable secret is that the enable password command is not encrypted by default. If the enable password is set, followed by the enable secret, the enable secret will override the enable password ITCK NOC-MZ Ahmadzai 4

5 Continued There are multiple ways to access a device to perform configuration tasks. One of these ways is to use a PC attached to the console port on the device. This type of connection is frequently used for initial device configuration. To set the password for console connection access, first enter the global configuration mode. Once there, use the following command: Router(config)#line console 0 Router(config-line)#password [password] Router(config-line)#login ITCK NOC-MZ Ahmadzai 5

6 Continued This will prevent unauthorized users from accessing user mode from the console port. Once the device is connected to the network, it can be accessed over the network connection. When the device is accessed through the network, it is considered a virtual terminal connection. The password must be configured on the virtual port. Router(config)#line vty 0 4 Router(config-line)#password [password] Router(config-line)#login ITCK NOC-MZ Ahmadzai 6

7 Continued To verify that the passwords are set correctly, use the show running-config command. These passwords are stored in the running-configuration in clear text. It is possible to set encryption on all passwords stored within the router, so that they are not easily seen by unauthorized individuals. The command service password encryption will ensure that passwords are encrypted ITCK NOC-MZ Ahmadzai 7

8 Configuring an interface In order for a router to direct traffic from one network to another, the interfaces on the router are configured to participate in each of the networks. A router interface connects to a network and has an IP address and subnet mask assigned to it that is appropriate for that network. There are many different types of interfaces available. Serial and Ethernet interfaces are the most common. Local network connections use Ethernet interfaces. WAN connections require the use of a serial connection through a TSP. Unlike Ethernet interfaces, serial interfaces require a clock signal to control the timing of the communications, this is known as a clock rate ITCK NOC-MZ Ahmadzai 8

9 Continued In most environments, Data Communications Equipment (DCE) devices such as a modem, or CSU/DSU, provides the clock rate. By default, Cisco routers are DTE devices, or Data Terminal equipment. This means that they accept the clock rate from the DCE device. Router can be configured as DCE devices, if necessary. If the router is connected as the DCE device, a clock rate must be set on the router interface to control the timing of the DCE/DTE connection ITCK NOC-MZ Ahmadzai 9

10 Continued ITCK NOC-MZ Ahmadzai 10

11 Configuration Steps To configure any interface on the router, it is necessary to be in the global configuration mode. Configuring an Ethernet interface is very similar to configuring a serial interface. One of the main differences is that a serial interface must have a clock rate set if it is acting as a DCE device. The steps to configure an interface include: Specify the type of interface and the interface port number Specify a description of the interface Configure the interface IP address and subnet mask Set the clock rate, if configuring a serial interface as a DCE Enable the interface ITCK NOC-MZ Ahmadzai 11

12 Continued ITCK NOC-MZ Ahmadzai 12

13 Configuring Default Route A router will forward packets from one network to another based on the destination IP address specified in the packet. If the router does not have a route to a specific network in its routing table, a default route can be configured to tell the router how to forward the packet. Usually the default route points to the next hop router on the path to the Internet. To configure the default route on a Cisco ISR you must be in Global configuration mode: ITCK NOC-MZ Ahmadzai 13

14 Continued ITCK NOC-MZ Ahmadzai 14

15 Configuring Static Routes The steps to configure a static route on a Cisco router are as follows: Connect to the router using a console cable Open a HyperTerminal window to connect with the first router that you want to configure. Enter privileged mode, by typing enable at the Router1> prompt. Note how the > symbol changes to a # to indicate that privilege mode is operative. Router1>enable Router1# ITCK NOC-MZ Ahmadzai 15

16 Configuration Steps Enter global configuration mode. Router1#config terminal Router1(config)# Use the ip route IOS command to configure the static route, with the following format: ip route [destination_network] [subnet_mask] [gateway_address] For example, to enable Router1 to reach a host on network , the administrator configures a static route on Router1 with the following IOS command in the global configuration mode: Router1(config) #ip route ITCK NOC-MZ Ahmadzai 16

17 RIP Configuration RIP is a popular distance vector protocol supported by most routers. It is an appropriate choice for small networks containing multiple routers. Before configuring RIP on a router, think about the networks a router serves, and the interfaces on the router that connect to these networks. The figure shows three routers. Each router serves a separate private local network, so there are three LANs. The routers are connected by separate networks as well, so there are a total of six networks shown ITCK NOC-MZ Ahmadzai 17

18 Our Network Topology ITCK NOC-MZ Ahmadzai 18

19 Continued With a topology like this, be careful not to assume that R1 links directly to /8 and /16. R1 will be able to reach those networks once RIP routing is properly configured. Before configuring RIP, assign an IP address and enable all the physical interfaces that will participate in routing. On serial links, set the clock rate on the master router. After this is done, configure RIP ITCK NOC-MZ Ahmadzai 19

20 RIP Continued For the most basic RIP configuration, there are three commands to remember: Router(config)#router rip Router (config-router)#version 2 Router(config-router)#network [network-number] Enter the router rip command in global configuration mode to enable RIP on the router. Enter the network command from router configuration mode to tell the router which networks will be part of the RIP routing process. The routing process associates specific interfaces with the network-numbers and begins to send and receive RIP updates on these interfaces ITCK NOC-MZ Ahmadzai 20

21 Finalizing RIP ITCK NOC-MZ Ahmadzai 21

22 Power up the Cisco Switch Powering up a Cisco 2960 switch is similar to powering up a Cisco 1841 ISR. Perform this procedure to power up a Cisco 2960 switch. The three basic steps for powering up a switch include: Check the Components Connect the Cables to the Switch Power on the Switch Once the switch is on, the power-on self-test (POST) begins. During POST, the LEDs blink while a series of tests determine that the switch is functioning properly ITCK NOC-MZ Ahmadzai 22

23 Continued POST has completed when the SYST LED rapidly blinks green. If the switch fails POST, the SYST LED turns amber. When a switch fails the POST test, it is necessary to return the switch for repairs Once all startup procedures are finished, the Cisco 2960 switch is ready to configure ITCK NOC-MZ Ahmadzai 23

24 Components we need ITCK NOC-MZ Ahmadzai 24

25 Continued There are multiple options available to configure a Cisco IOS Command Line Interface (CLI) Cisco Network Assistant Cisco Device Manager CiscoView Management Software SNMP Network Management Productsnd manage a Cisco ITCK NOC-MZ Ahmadzai 25

26 Continued The Cisco Catalyst 2960 switch comes preconfigured and only needs to be assigned basic security information before being connected to the network. The commands to configure hostname and passwords on the switch are the same commands used to configure the ISR. In order to use an IP-based management product or Telnet with a Cisco switch, configure a management IP address. There is one virtual local network, VLAN 1, preconfigured in the switch to provide access to management functions. To configure the IP address assigned to the management interface on VLAN 1, enter global configuration mode ITCK NOC-MZ Ahmadzai 26

27 Continued Save the configuration by using the copy running-configuration startup-configuration command ITCK NOC-MZ Ahmadzai 27

28 What is VLAN? Hosts and servers that are connected to Layer 2 switches are part of the same network segment. This arrangement poses two significant problems: Switches flood broadcasts out all ports, which consumes unnecessary bandwidth. As the number of devices connected to a switch increases, more broadcast traffic is generated and more bandwidth is wasted. Every device that is attached to a switch can forward and receive frames from every other device on that switch ITCK NOC-MZ Ahmadzai 28

29 What is VLAN? As a network design best practice, broadcast traffic is contained to the area of the network in which it is required. There are business reasons why certain hosts access each other while others do not. As an example, members of the accounting department may be the only users who need to access the accounting server. In a switched network, virtual local area networks (VLANs) are created to contain broadcasts and group hosts together in communities of interest ITCK NOC-MZ Ahmadzai 29

30 What is VLAN? A VLAN is a logical broadcast domain that can span multiple physical LAN segments. It allows an administrator to group together stations by logical function, by project teams, or by applications, without regard to physical location of the users ITCK NOC-MZ Ahmadzai 30

31 VLAN Concept ITCK NOC-MZ Ahmadzai 31

32 Virtual Vs Physical Nets The difference between a physical network and a virtual, or logical, network can be shown in the following example: The students in a school are divided into two groups. In the first group, each student is given a red card, for identification. In the second group, each student is given a blue card. The principal announces that students with red cards can only speak to other students with red cards and that students with blue cards can only speak to other students with blue cards. The students are now logically separated into two virtual groups, or VLANs ITCK NOC-MZ Ahmadzai 32

33 Continued Each VLAN functions as a separate LAN. A VLAN spans one or more switches, which allows host devices to behave as if they were on the same network segment. A VLAN has two major functions: A VLAN contains broadcasts. A VLAN groups devices. Devices located on one VLAN are not visible to devices located on another VLAN. Traffic requires a Layer 3 device to move between VLANs. In a switched network, a device can be assigned to a VLAN based on its location, MAC address, IP address, or the applications that the device most frequently uses. Administrators assign membership in a VLAN either statically or dynamically ITCK NOC-MZ Ahmadzai 33

34 Static VLAN Static VLAN membership requires an administrator to manually assign each switch port to a specific VLAN. As an example, port fa0/3 may be assigned to VLAN 20. Any device that plugs into port fa0/3 automatically becomes a member of VLAN 20. This type of VLAN membership is the easiest to configure and is also the most popular, however, it requires the most administrative support for adds, moves and changes. For example, moving a host from one VLAN to another requires either the switch port to be manually reconfigured to the new VLAN or the workstation cable to be plugged into a different switchport on the new VLAN ITCK NOC-MZ Ahmadzai 34

35 Continued ITCK NOC-MZ Ahmadzai 35

36 Dynamic VLAN Dynamic VLAN membership requires a VLAN management policy server (VMPS). The VMPS contains a database that maps MAC addresses to VLAN assignments. When a device plugs into a switch port, the VMPS searches the database for a match of the MAC address and temporarily assigns that port to the appropriate VLAN. Dynamic VLAN membership requires more organization and configuration but creates a structure with much more flexibility than static VLAN membership. In dynamic VLAN, moves, adds, and changes are automated and do not require intervention from the administrator ITCK NOC-MZ Ahmadzai 36

37 Activity ITCK NOC-MZ Ahmadzai 37

38 VLAN Configuration Whether VLANs are created statically or dynamically, the maximum number of VLANs depends on the type of switch and the IOS. By default, VLAN1 is the management VLAN. An administrator will use the IP address of the management VLAN to configure the switch remotely. When accessing the switch remotely, the network administrator can configure and maintain all VLAN configurations. Additionally, the management VLAN is used to exchange information, such as Cisco Discovery Protocol (CDP) traffic and VLAN Trunking Protocol (VTP) traffic, with other networking devices ITCK NOC-MZ Ahmadzai 38

39 Continued When a VLAN is created, it is assigned a number and a name. The VLAN number is any number from the range available on the switch, except for VLAN1. Some switches support approximately 1000 VLANs; others support more than Naming a VLAN is considered a network management best practice. Use the following commands to create a VLAN using global configuration mode: Switch(config)#vlan vlan_number Switch(config-vlan)#name vlan_name Switch(config-vlan)#exit ITCK NOC-MZ Ahmadzai 39

40 Configuration Steps Assign ports to be members of the VLAN. By default, all ports are initially members of VLAN1. Assign ports one at a time or as a range. Use the following commands to assign individual ports to VLANs: Switch(config)#interface fa#/# Switch(config-if)#switchport access vlan vlan_number Switch(config-if)# exit Use the following commands to assign a range ports to VLANs Switch(config)#interface range fa#/start_of_range - end_of_range Switch(config-if)#switchport access vlan vlan_number Switch(config-if)#exit ITCK NOC-MZ Ahmadzai 40

41 Example ITCK NOC-MZ Ahmadzai 41

42 VLAN Tagging Devices connected to a VLAN only communicate with other devices in the same VLAN, regardless of whether those devices are on the same switch or different switches. A switch associates each port with a specific VLAN number. As a frame enters that port, the switch inserts the VLAN ID (VID) into the Ethernet frame. The addition of the VLAN ID number into the Ethernet frame is called frame tagging. The most commonly used frame tagging standard is IEEE 802.1Q ITCK NOC-MZ Ahmadzai 42

43 Continued ITCK NOC-MZ Ahmadzai 43

44 Continued The 802.1Q standard, sometimes abbreviated to dot1q, inserts a 4-byte tag field into the Ethernet frame. This tag sits between the source address and the type/length field. Ethernet frames have a minimum size of 64 bytes and a maximum size of 1518 bytes, however a tagged Ethernet frame can be up to 1522 bytes in size. The FCS field provides error checking to ensure the integrity of all of the bits within the frame ITCK NOC-MZ Ahmadzai 44

45 Activity ITCK NOC-MZ Ahmadzai 45

46 VLAN Removal To verify, maintain, and troubleshoot VLANs, it is important to understand the key show commands that are available in the Cisco IOS. show vlan show vlan brief The removal of VLANs and the reassignment of ports to different VLANs are two separate and distinct functions. When a port is disassociated from a specific VLAN, it returns to VLAN1. To delete a VLAN: Switch(config)#no vlan vlan_number To disassociate a port from a specific VLAN: Switch(config)#interface fa#/# Switch(config-if)#no switchport access vlan vlan_number ITCK NOC-MZ Ahmadzai 46

47 TRUNK Ports A VLAN has three major functions: Limits the size of broadcast domains Improves network performance Provides a level of security To take full advantage of the benefits of VLANs, they are extended across multiple switches. Switch ports can be configured for two different roles. A port is classified as either an access port or a trunk port. Access Port An access port belongs to only one VLAN. Typically, single devices such as PCs or servers connect to this type of port. If a hub connects multiple PCs to the single access port, each device connected to the hub is a member of the same VLAN ITCK NOC-MZ Ahmadzai 47

48 Trunk Port Trunk Port A trunk port is a point-to-point link between the switch and another networking device. Trunks carry the traffic of multiple VLANs over a single link and allow VLANs to reach across an entire network. Trunk ports are necessary to carry the traffic from multiple VLANs between devices when connecting either two switches together, a switch to a router, or a host NIC that supports 802.1Q trunking ITCK NOC-MZ Ahmadzai 48

49 Trunk Ports & Access Ports ITCK NOC-MZ Ahmadzai 49

50 Trunk Port Configuration Switch ports are access ports by default. To configure a switch port as a trunk port, use the following commands: Switch(config)#interface fa(controler # / port #) Switch(config-if)#switchport mode trunk Switch(config-if)#switchport trunk encapsulation {dot1q isl negotiate} Switches that support both 802.1Q and ISL require the last configuration statement. The 2960 does not require that statement because it only supports 802.1Q. The negotiate parameter is the default mode on many Cisco switches. This parameter automatically detects the encapsulation type of the neighbor switch ITCK NOC-MZ Ahmadzai 50

51 Continued Newer switches have the capability to detect the type of link configured at the other end. Based on the attached device, the link configures itself as either a trunk port or an access port. Switch(config-if)#switchport mode dynamic {desirable auto} In desirable mode, the port becomes a trunk port if the other end is set to either trunk, desirable, or auto. In auto mode, the port becomes a trunk port if the other end is set to either trunk or desirable. To return a trunk port to an access port, issue either of the following commands: witch(config)#interface fa(controler # / port #) Switch(config-if)#no switchport mode trunk or Switch(config-if)#switchport mode access ITCK NOC-MZ Ahmadzai 51

52 Inter VLAN Routing ITCK NOC-MZ Ahmadzai 52

53 Inter VLAN Routing Although VLANs extend to span multiple switches, only members of the same VLAN can communicate. A Layer 3 device provides connectivity between different VLANs. This arrangement enables the network administrator to strictly control the type of traffic that flows from one VLAN to another. One method of accomplishing the inter-vlan routing requires a separate interface connection to the Layer 3 device for each VLAN. Another method for providing connectivity between different VLANs requires a feature called subinterfaces. Subinterfaces logically divide one physical interface into multiple logical pathways. Configure one pathway or subinterface for each VLAN ITCK NOC-MZ Ahmadzai 53

54 Sub-Interface ITCK NOC-MZ Ahmadzai 54

55 Inter VLAN Routing Configuration To configure inter-vlan routing, use the following steps: Configure a trunk port on the switch. Switch(config)#interface fa0/2 Switch(config-if)#switchport mode trunk On the router, configure a FastEthernet interface with no IP address or subnet mask. Router(config)#interface fa0/1 Router(config-if)#no ip address Router(config-if)#no shutdown On the router, configure one subinterface with an IP address and subnet mask for each VLAN. Each subinterface has an 802.1Q encapsulation ITCK NOC-MZ Ahmadzai 55

56 Finalizing Configuration Router(config)#interface fa0/0.10 Router(config-subif)#encapsulation dot1q 10 Router(config-subif)#ip address Use the following commands to verify the inter-vlan routing configuration and functionality. Switch#show trunk Router#show ip interfaces Router#show ip interfaces brief Router#show ip route ITCK NOC-MZ Ahmadzai 56

57 ITCK NOC-MZ Ahmadzai 57