4 Ethernet Switching and the Cisco IOS CLI · CCNA

Exam topics covered

1.13 Describe switching concepts

1.13.a MAC learning and aging · 1.13.b Frame switching · 1.13.c Frame flooding · 1.13.d MAC address table

4.8 Configure network devices for remote access using SSH (introduced; detailed in Chapter 26)

5.3 Configure and verify device access control using local passwords (introduced; detailed in Chapter 29)

Foundation. The LAN switch is the most numerous device in any enterprise network, and it is the first Cisco device most CCNA candidates configure. This chapter explains exactly how a switch decides what to do with each frame: how it learns MAC addresses, when it forwards, filters or floods, and how entries age out. You will then learn the Cisco IOS command-line interface—access methods, command modes, help and editing features, and the difference between running and startup configurations—and finish by configuring a switch from factory defaults with a hostname, passwords, a banner and a management IP address.

4.1 From Hubs to Switches

A hub is a multiport repeater. It regenerates every bit it receives out every other port, so all connected devices share the bandwidth, hear every frame and must take turns using CSMA/CD. All ports on a hub form a single collision domain: the set of devices whose transmissions can collide.

A switch (originally a multiport bridge) reads the destination MAC address of each frame and forwards it only out of the port where that address lives. Each switch port is a separate collision domain, and with full duplex, collisions do not happen at all. However, a switch still forwards broadcasts out every port in the same VLAN, so all of its ports form one broadcast domain: the set of devices that receive each other's broadcast frames. Only a router (or a Layer 3 switch routing between VLANs) separates broadcast domains, because it does not forward Layer 2 broadcasts.

Figure 4-1 Two broadcast domains (one per router interface). Every switch port and router port is its own collision domain, except that the hub and its two PCs share one.

Exam alert

Counting domains is a classic question. Collision domains: count one per link on a switch or router port; a hub and everything attached to it counts as one. Broadcast domains: count router interfaces (or VLANs); switches and hubs do not split them. In Figure 4-1 there are 7 collision domains and 2 broadcast domains.

4.2 How a Switch Forwards Frames

A switch makes every decision using its MAC address table (also called the CAM table, after the content-addressable memory that stores it). Each entry maps a MAC address in a VLAN to the port where it was seen. A switch performs three jobs:

1. Learning — it examines the source MAC address of every incoming frame and records (or refreshes) that address against the incoming port and VLAN.
2. Forwarding or filtering — it looks up the destination MAC address. If the address is known on a different port, it forwards the frame out that port only. If it is known on the same port the frame arrived on, it filters (discards) the frame.
3. Flooding — if the destination is unknown (an unknown unicast), a broadcast, or a multicast the switch is not tracking, it floods the frame out every port in the VLAN except the one it came in on.

4.2.1 MAC learning step by step

Figures 4-2 and 4-3 follow a switch that has just booted with an empty table. PC-A (MAC 0050.7966.000A) sends a frame to PC-C (0050.7966.000C).

Gi0/1
Gi0/2
Gi0/3
PC-A ...000A PC-B ...000B PC-C ...000C
Frame: src 000A → dst 000C

1. Learn 000A on Gi0/1. 2. 000C unknown → flood

Figure 4-2 Step 1: SW1 learns PC-A's address from the source MAC and floods the frame because PC-C is unknown. PC-B receives and discards it.

3. Learn 000C on Gi0/3. 4. 000A known on Gi0/1 → forward

Figure 4-3 Step 2: PC-C replies. SW1 learns PC-C's location and forwards the reply only out Gi0/1. From now on, traffic between A and C is never flooded.

4.2.2 Aging and moves

Dynamic entries do not stay forever. Every time a frame arrives from a MAC address, the switch resets that entry's timer. If no frame is seen for the aging time—300 seconds by default on Catalyst switches—the entry is removed, freeing space and allowing for devices that have moved or been unplugged. If a known MAC address suddenly appears on a different port (a laptop moved to another desk), the switch simply updates the entry to the new port. When a port goes down, the switch flushes the entries learned on it. The table has a finite size (thousands to tens of thousands of entries depending on the platform); when it is full, new addresses cannot be learned and frames to them are flooded—the basis of the MAC flooding attack covered in Chapter 31.

Frame arrives on port P

Learn/refresh source MAC on port P (reset age)

Destination MAC?

broadcast / unknown
known, other port
known, same port P

Flood

all ports in VLAN except P

Forward

out that one port

Filter

discard the frame

Figure 4-4 The switch's decision for every frame: learn the source, then flood, forward or filter based on the destination.

4.2.3 Switching methods

Switches can begin forwarding at different points. Store-and-forward receives the whole frame and checks the FCS before forwarding, so corrupted frames are dropped; this is the default on most Catalyst switches. Cut-through starts forwarding as soon as the destination MAC has been read, minimising latency but passing on errored frames (common in low-latency data centre switches). Fragment-free waits for the first 64 bytes, filtering out most collision fragments.

4.2.4 Viewing the MAC address table

Use show mac address-table to view the table. Static entries for the CPU (used for protocols such as CDP and STP) appear first. You can filter by dynamic , address , interface or vlan , view the aging time, and clear dynamic entries with clear mac address-table dynamic .

SW1# show mac address-table dynamic

Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0050.7966.000a DYNAMIC Gi0/1
1 0050.7966.000b DYNAMIC Gi0/2
1 0050.7966.000c DYNAMIC Gi0/3
1 5254.0012.3456 DYNAMIC Gi0/24
1 7069.5a3b.9901 DYNAMIC Gi0/24
Total Mac Addresses for this criterion: 5

SW1# show mac address-table address 0050.7966.000c

Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0050.7966.000c DYNAMIC Gi0/3
Total Mac Addresses for this criterion: 1

SW1# show mac address-table aging-time

Global Aging Time: 300
Vlan Aging Time
---- ----------

SW1# show mac address-table count

Figure 4-5 Viewing the MAC address table. Several MACs on Gi0/24 indicate another switch or router is connected there. Output is illustrative of IOS 15/IOS XE.

Tip

Note that Cisco displays MAC addresses in lowercase in the table, but accepts either case when you type them. When tracing a device, combine show mac address-table address with show ip arp on the router to map an IP address to a switch port.

4.3 Accessing the Cisco IOS CLI

Cisco switches and routers run the IOS or IOS XE operating system, managed mainly through a text command-line interface (CLI). You can reach the CLI in three ways:

Console port — a direct, out-of-band connection using an RJ-45 rollover cable (with a USB-to-serial adapter) or a USB mini-B/USB-C console port. Use a terminal emulator such as PuTTY or Tera Term with the default settings 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. You need the console for initial setup and when the network is down.

SSH — encrypted remote access over the network to the device's IP address (TCP port 22). This is the standard for day-to-day management.

Telnet — unencrypted remote access (TCP port 23). It sends passwords in clear text and should not be used on production networks.

Remote access (SSH/Telnet) uses virtual terminal (vty) lines; a Catalyst switch usually has 16 ( line vty 0 15 ). Many devices also offer a web GUI and programmatic APIs, covered in Part VI.

4.3.1 Command modes

IOS organises commands into modes, each identified by its prompt. Every mode allows a specific set of commands, which protects the device from accidental changes. User EXEC

SW1>
limited show, ping

Privileged EXEC

SW1#
all show, copy, reload, debug

Global configuration

SW1(config)#
device-wide settings

Interface config

SW1(config-if)#

Line config

SW1(config-line)#
enable
disable
conf t
end / Ctrl-Z
interface g0/1 line vty 0 15
exit = up one level
end = back to privileged EXEC

Figure 4-6 IOS command modes and how to move between them.

Configuration commands take effect immediately in the running configuration. To run a privileged EXEC command (such as show ) without leaving configuration mode, prefix it with do , for example do show ip interface brief . To remove or reverse a configuration command, repeat it with no in front.

4.3.2 Help, abbreviations and history

IOS has excellent built-in help. Type ? alone to list the commands available in the current mode; type a partial word followed immediately by ? (no space) to list commands that start with it; type a command, a space and ? to see the next keyword or argument. The Tab key completes a partially typed keyword. Commands may be abbreviated to the shortest unambiguous string: conf t , sh ip int br , int g0/1 , copy run start .

SW1# cl?
clear clock
SW1# clock ?

read-calendar Read the hardware calendar into the clock
set Set the time and date
update-calendar Update the hardware calendar from the clock

SW1# sh mac add

% Ambiguous command: "sh mac add" <- "add" matches address and address-table

SW1# show interfaces
SW1# configure terminal
SW1(config)# hostnmae SW1

% Invalid input detected at '^' marker.

SW1(config)# interface

% Incomplete command.

SW1(config)# do show history
show interfaces
configure terminal
do show history

Figure 4-7 Context-sensitive help and the three common error messages: ambiguous, invalid input and incomplete.

Table 4-1 Useful CLI editing keys

Key Action

Up arrow / Ctrl-P Recall the previous command from history (10 commands by default; change with terminal history size )

Down arrow / Ctrl-NRecall the next command
Tab Complete the current keyword
Ctrl-A / Ctrl-E Move to the beginning / end of the line

Ctrl-Z Exit configuration mode to privileged EXEC (same as end )

Ctrl-Shift-6 Interrupt a running command, such as a long ping or traceroute Space / Enter at --

More--
Show the next page / next line of output
4.3.3 Running and startup configurations

A Cisco device holds two configurations. The running-config lives in RAM and is the configuration in use right now; every configuration command changes it immediately. The startup-config is stored in NVRAM and is loaded when the device boots. Changes you make are lost on reload unless you copy the running configuration to the startup configuration. The IOS image itself is stored in flash, and the bootstrap program in ROM.

Ram

running-config

active; lost on reload

Nvram

startup-config
loaded at boot
copy running-config startup-config
(or write memory)
reload (copied at boot)

Flash: IOS image files erase startup-config = factory reset on next boot ROM: bootstrap, ROMMON Where configuration and software live

Figure 4-8 Running versus startup configuration and the memory types in a Cisco device.

Table 4-2 Configuration file commands

Command Effect
show running-config Display the active configuration
show startup-config Display the saved configuration
copy running-config startup-config /
write memory
Save the active configuration

copy startup-config running-config Merge the saved configuration into the running one (does not replace it)

erase startup-config / write erase Delete the saved configuration; after reload the device boots with defaults

reload Restart the device

Watch out

On a switch, erase startup-config does not delete VLANs, which are stored separately in flash:vlan.dat . To fully reset a lab switch, also run delete flash:vlan.dat before reloading.

4.4 Basic Switch Configuration

A Layer 2 switch forwards frames without any configuration at all. You configure it to give it an identity, secure access to it, and make it reachable for management. The essential tasks are below; Chapter 29 extends them with stronger device hardening.

Hostname — identifies the device in prompts, logs and CDP.

Enable secret — protects privileged EXEC mode with a hashed password. enable secret always overrides the older, weakly protected enable password .

Console and vty passwords — the password plus login commands under each line require a password to connect. Better still, create local usernames and use login local . service password-encryption — applies weak (type 7) encryption to plain-text passwords in the configuration so they cannot be read over someone's shoulder.

Banner — banner motd displays a legal warning before login.

Management IP address — a Layer 2 switch has no IP addresses on its physical ports. Instead you assign one to a switch virtual interface (SVI), such as interface vlan 1 or a dedicated management VLAN, and enable it with no shutdown .

Default gateway — ip default-gateway lets the switch reply to management stations in other subnets. (A Layer 3 switch with routing enabled uses a default route instead.)

Exam alert

A Layer 2 switch needs ip default-gateway to be managed from another subnet. Without it, a remote SSH session fails even though local pings succeed. Also remember that the SVI is up/up only if it is not shut down and at least one port in that VLAN is up (or a trunk carries the VLAN).

4.4.1 Verifying the switch

The show version command reports the IOS version, uptime, reason for the last reload, the image file, hardware model, memory, interface counts and the configuration register. show interfaces status gives a one-line summary per port, and show ip interface brief lists interfaces with IP addresses and status.

SW1# show version

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.2(7)E8, RELEASE SOFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport

ROM: Bootstrap program is C2960X boot loader

BOOTLDR: C2960X Boot Loader (C2960X-HBOOT-M) Version 15.2(7r)E, RELEASE SOFTWARE (fc1) SW1 uptime is 3 weeks, 2 days, 4 hours, 17 minutes

System returned to ROM by power-on

System image file is "flash:c2960x-universalk9-mz.152-7.E8.bin"

Last reload reason: power-on

cisco WS-C2960X-24TS-L (APM86XXX) processor (revision D0) with 524288K bytes of memory. Processor board ID FOC2041X0AB

Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
28 Gigabit Ethernet interfaces

The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address : 70:69:5A:3B:99:00
Model number : WS-C2960X-24TS-L
System serial number : FOC2041X0AB
Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 28 WS-C2960X-24TS-L 15.2(7)E8 C2960X-UNIVERSALK9-M
Configuration register is 0xF

Figure 4-9 show version on a Catalyst 2960-X: software version, uptime, image file, model and memory.

LAB Configure a switch from factory defaults

Goal: Give SW1 a name, secure console, privileged and remote access, add a banner, and make it manageable at 192.168.1.2 from other subnets through gateway R1.

R1
G0/0 192.168.1.1
SW1
console (rollover) from laptop

Svi vlan 1: 192.168.1.2/24

Figure 4-10 Lab topology: SW1 is managed through an SVI in VLAN 1 with R1 as its default gateway.

Steps: Connect to the console (9600 8N1), answer no to the setup dialog, and enter:

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# enable secret Cisc0-Lab! ! hashed privileged-mode password
SW1(config)# service password-encryption
SW1(config)# no ip domain-lookup ! typos are not treated as hostnames
SW1(config)# banner motd # Authorized access only. Activity is logged. #
SW1(config)# line console 0
SW1(config-line)# password C0nsole!
SW1(config-line)# login
SW1(config-line)# logging synchronous ! log messages don't break your typing
SW1(config-line)# exec-timeout 10 0
SW1(config-line)# exit
SW1(config)# username admin secret Adm1n-Lab!
SW1(config)# ip domain-name lab.local
SW1(config)# crypto key generate rsa modulus 2048 ! required for SSH
SW1(config)# ip ssh version 2
SW1(config)# line vty 0 15
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# exit
SW1(config)# interface vlan 1
SW1(config-if)# ip address 192.168.1.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# ip default-gateway 192.168.1.1
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# description Admin-PC
SW1(config-if)# end
SW1# copy running-config startup-config

Verify:

SW1# show ip interface brief | exclude unassigned

Interface IP-Address OK? Method Status Protocol

Vlan1 192.168.1.2 YES manual up up

SW1# show interfaces status

Port Name Status Vlan Duplex Speed Type
Gi0/1 Admin-PC connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/2 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/3 notconnect 1 auto auto 10/100/1000BaseTX

...

Gi0/24 connected 1 a-full a-1000 10/100/1000BaseTX

SW1# show running-config | section line vty
line vty 0 4
login local
transport input ssh
line vty 5 15
login local
transport input ssh
SW1# ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

Figure 4-11 Verifying the management SVI, port status, vty configuration and reachability of the default gateway.

Expected result: The Vlan1 SVI is up/up with 192.168.1.2. From the admin PC, ssh -l admin 192.168.1.2 shows the banner and prompts for the password; the console asks for the console password; and show running-config shows the console password encrypted as type 7 and the enable secret hashed. After reload , the configuration is still there. Chapter review

Ssh

user EXEC mode
privileged EXEC mode
global configuration mode
running-config
startup-config

Nvram

enable secret
service password-encryption
banner motd

Svi

ip default-gateway

1. Which address does a switch use to populate its MAC address table?

A. Destination MAC address
B. Source MAC address
C. Destination IP address
D. Source IP address

2. A switch receives a frame whose destination MAC address is not in its MAC address table. What does it do?

A. Drops the frame
B. Sends an ARP request
C. Floods the frame out all ports in the VLAN except the incoming port
D. Forwards the frame to the default gateway

3. What is the default MAC address table aging time on a Catalyst switch?

A. 60 seconds
B. 300 seconds
C. 4 hours
D. Entries never age

4. Which two types of frames does a switch flood? (Choose two.)

A. Known unicast
B. Broadcast
C. Unknown unicast
D. Frames with a CRC error
E. Frames whose destination is on the incoming port

5. A network has one router with two LAN interfaces. Each interface connects to a 24-port switch with 10 PCs attached. How many broadcast domains are there?

A. 1
B. 2
C. 20
D. 22

6. A switch receives a frame on Gi0/5, and its table shows the destination MAC on Gi0/5. What does the switch do?

A. Floods the frame
B. Forwards the frame out Gi0/5
C. Filters (discards) the frame
D. Sends the frame to the CPU

7. Which command moves from user EXEC mode to privileged EXEC mode?

A. configure terminal
B. enable
C. login
D. privilege

8. An engineer configures a switch and then reloads it without saving. What happens?

A. The running configuration is restored from NVRAM unchanged
B. The changes are lost because the startup-config was not updated
C. The switch saves the configuration automatically
D. The switch boots into ROMMON

9. Which two commands are required for a Layer 2 switch to be managed by SSH from a host in a different subnet? (Choose two.)

A. ip route 0.0.0.0 0.0.0.0
B. ip address on an SVI
C. ip default-gateway
D. ip routing
E. enable password

10. An engineer types sh mac add and receives an error. Which error is displayed?

A. % Invalid input detected
B. % Incomplete command
C. % Ambiguous command
D. % Unknown command

11. Both enable password and enable secret are configured with different values. Which is used?

A. enable password
B. enable secret
C. Either one
D. Neither; the console password is used

12. Which command displays the IOS image file name, uptime and configuration register?

A. show running-config
B. show flash
C. show version
D. show interfaces status

13. What are the default console settings for a Cisco device?

A. 9600 baud, 8 data bits, no parity, 1 stop bit
B. 115200 baud, 7 data bits, even parity, 1 stop bit
C. 19200 baud, 8 data bits, odd parity, 2 stop bits
D. 9600 baud, 8 data bits, no parity, 2 stop bits, hardware flow control Answers

1. B. Switches learn by recording the source MAC address against the incoming port. They use the destination MAC only to make forwarding decisions.
2. C. Unknown unicast frames are flooded out all ports in the VLAN except the one they arrived on. Switches do not ARP for frames or use a gateway to forward Layer 2 frames.
3. B. The default aging time is 300 seconds (5 minutes). Four hours is the IOS ARP timeout.
4. B, C. Broadcasts and unknown unicasts are flooded. Known unicasts are forwarded; errored frames are dropped by store-and-forward switches; frames destined to the incoming port are filtered.
5. B. Each router interface defines a broadcast domain; switches do not divide them (without VLANs).
6. C. If the destination is on the same port the frame arrived on, the switch filters it.
7. B. enable enters privileged EXEC; configure terminal then enters global configuration mode.
8. B. The running configuration lives in RAM. Without copy running-config startup-config , changes are lost on reload.
9. B, C. The switch needs an IP address on an SVI and a default gateway. ip routing and default routes apply to Layer 3 operation.
10. C. add could match more than one keyword ( address , address-table ), so the command is ambiguous.
11. B. enable secret always takes precedence over enable password .
12. C. show version reports the software version, image file, uptime, hardware and configuration register.
13. A. The defaults are 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.