Switch

The main task of a switch is to unite devices into a single network. It transmits data received on one of its interfaces to another based on the source and destination MAC address information contained in the transmitted frame.

Their logic is based on the Switching Table. As soon as a new host appears on the network and tries to transmit any information, the switch records that a new MAC address has appeared on one of its interfaces. A switch records this data in the form of a table like this:

Interface X - MAC address Y

Cisco Systems' advertising announcements will tell you about the latest 21st-century technologies in the all-new Cisco Catalyst 9200 series of switches, which is positioned to create LANs for small and medium-sized offices.

Everything new and technological is always liked by IT directors and other management personnel, but not by network engineers and IT administrators. But do not be afraid this time, because the new bright design and improved features essentially hides the updated, but good old Cisco 2960 switch, used everywhere, loved by network engineers for its ease of setup, convenience and reliability.

Cisco Catalyst 9200 Switch Overview and Configuration

Configure Cisco Catalyst 9200

Configuring a Cisco Catalyst 9200 switch is almost exactly the same as configuring a Cisco Catalyst 2960 switch, with the exception of a few new features that will not be required by most companies.

You can safely use the following articles to configure the Cisco Catalyst 9200 as a switch for connecting users, printers, and other LAN resources. The differences will only be in the configuration of the interfaces, since the Cisco 9200 has at least 1G.

The etherchannel (also called port channel sometimes) technology allows to combine several physical switch ports (from 2 to 8 total) into one logical port. This technology is often used to increase reliability of a connection between two devices. Traffic uses all active ports and, in case one physical port fails, this will have no effect on the overall availability of the connection. Naturally, the connection bandwidth is increased, as well.

Important!
It's important to remember that such a connection can be created only using ports with of the same speed. For example, using two FastEthernet (100 + 100 Mbps) or two GigabitEthernet (1 + 1 Gbps) ports. You cannot combine a FastEthernet (100 Mbps) and a GigabitEthernet (1 Gbps) port into the same etherchannel.

Important!
Etherchannel settings must be identical on both devices that are using it, no matter whether you're connecting a switch to a switch or a switch and a server.

For this example, we will look at configuring two Cisco switches. Let it be Cisco Catalyst 3560, although the technology and command syntax are universal and practically identical for all models.

On the first switch, SW-DELTACONFIG-1, we need to create a logical interface port-channel with a unique sequence number (for example, 1)

SW-DELTACONFIG-1(config)#
interface port-channel1

Now we need to assign the needed amount of physical ports to the logical interface. Physical ports also need to be turned on with the "no shut" command.

SW-DELTACONFIG-1(config)#
interface Gi 0/1
channel-group 1 mode active
no shut

interface Gi 0/2
channel-group 1 mode active
no shut

Inside the logical(!) interface's configuration, we add all the relevant commands: link description, trunk or access port configuration, allowed VLAN tags and etc.
SW-DELTACONFIG-1(config)#
interface port-channel1
description ---Link to SW-DELTACONFIG-2---
switchport mode trunk
switchport trunk allowed vlan 1-10,20-30
no shut

All of these commands will be automatically added into the physical port configurations for the ports assigned to this port-channel. You can check this using the "show run interface [interface name]" command. In order to do it straight from the configuration mode, use the keyword "do" in front of the command:
SW-DELTACONFIG-1(config)# do sh run interface Gi 0/1
interface GigabitEthernet0/1
description ---Link to SW-DELTACONFIG-2---
switchport mode trunk
switchport trunk allowed vlan 1-10,20-30
channel-group 1 mode active

Important!
I strongly recommend creating portchannel interfaces in this exact order:
— First the logical interface itself
— Then assign physical ports to it
— Only after these steps make configuration changes of the logical interface. All commands will be automatically transferred to the physical ports, as well.
Such order of configuration will eliminate the possibility of making mistakes in settings, which is extremely important, for any discrepancies in parameters between physical ports will make the entire portchannel behave incorrectly.

Important!
After assigning a physical interface into the logical one, you make configuration changes to it. Any and all configuration changes are made (!) on the logical port-channel interfaces. Any change made to the configuration of a physical switch port that is included into a port-channel might lead to the failure of the entire aggregated connection.

The second switch, SW-DELTACONFIG-2, is configured in a similar fashion. For this example we are using same Cisco Catalyst 3560 model switches with identical interfaces. In this case, you can see difference in configuration only by the description field.

Checking settings
Additionally to checking that all the necessary lines are present in the switch's configuration through the "sh run" command, you should use the "show etherchannel summary" command to check the port channel operation:

The letter P next to the physical port names Gi 0/1 and Gi 0/2 means that the interfaces are working properly and are aggregated into the logical connection named Portchannel 1. The letter D next to an interface name would mean that the interface is inactive. Most likely you need to check the cable connections and all port settings.
Important!
Don't forget to save the configuration changes on all devices with the "write" or "copy run start" commands. Otherwise all the made changes will be lost after the next reload.
SWR-DELTACONFIG-1#write
Building configuration...
[OK]

This article was written by Alexey Yurchenko
Back to Table of contents

Let's consider a scenario in which there are two several departments of the same company that have to be connected using logically separate networks (VLANs) and need to communicate with each other, while being connected on a single Layer 3 switch Cisco 3560.
The task is to organize the following subnets (VLANs):
- Sales department network ( 255.255.255.0)
- Accounting department network ( 255.255.255.0)
- IT administrators network ( 255.255.255.0)
- Network management subnet ( 255.255.255.0)

Layer 2 switches are capable of of transferring data only within a single network, since they use Layer 2 MAC addresses in order to forward packets. Layer 3 devices are used to forward packets between various networks and use IP addresses to make forwarding decisions.
Layer 3 switch (such as the Cisco 3560) is a combination of an OSI Layer 2 device (Access layer) and a Layer 3 device (Network layer), such as a router. It is a switch and a router in one box.

One Cisco 3560 switch can, in theory, replace a combination of a Cisco 2960 switch and a Cisco 2811 router. Yet using such a switch for external connections is highly NOT recommended. ISP uplink and any external links should be connected into a separate router or firewall, while Layer 3 switches should only be used for internal routing.
(This article describes how a similar task of having several VLANs can be solved with a Layer 2 Cisco 2960 switch and a Cisco 2811 router.)
Step 0. Clear previous configuration
(This step should be performed only on new or test equipment, since it completely removes all existing configuration)
After you take your new switch out of the box, connect to it with a console cable and clear the factory configuration by entering the privileged mode and using the "write erase" command (you can learn more about Cisco IOS configuration modes in this article)
Switch > enable
Switch# write erase
/clear configuration acknowledgment/
Switch# reload
/reload acknowledgment/
After this your switch will reboot, taking about three minutes to do so, and display a request for basic configuration wizard afterwards. You should decline:
Would you like to enter the basic configuration dialog (yes/no): no
Step 1. Hostname
Let's call our switch SWR-DELTACONFIG-1 (SWR is an abbreviation from SWitch Router). To do this, enter the configuration mode (conf t) and type the following commands:
Switch# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)# hostname SWR-DELTACONFIG-1
SWR-DELTACONFIG-1(config)#
The hostname will change from "Switch" to the specified name.

Step 2. Configure remote access
In order to administer your switch remotely, you have to give it an IP address on VLAN 1. Don't forget to switch on the interface by using the "no shutdown" command:
SWR-DELTACONFIG-1(config)#
interface vlan 1
ip address 192.168.1.1 255.255.255.0
no shutdown
Step 3. Configure user authorization
In order for all users to be authorized and gain an access to the switch:

Create a password for accessing the privileged mode (indicated by the "#" sign after the hostname) with the command "enable secret"
Create a user account (and its password) for remote access with the command "username ... secret ..."

SWR-DELTACONFIG-1(config)#
enable secret *****
username admin secret *****
Turn on authorization using the local user and password database:
SWR-DELTACONFIG-1(config)#
line vty 0 4
login local
In order to check the availability of the privileged mode (#) after entering the above commands, exit all configuration modes by entering "exit" or "Ctrl+Z" until you are in the original ">" mode. After this try entering the privileged mode again using enable command and enter the password you specified above when asked.
If all commands were entered correctly, you should get something like this:
SWR-DELTACONFIG-1>enable
Password:  *****
SWR-DELTACONFIG-1#
You can also check the remote access by entering "telnet 192.168.1.1" from the command line of a workstation. You should get a request for username and password in a telnet window.
After you've ensured that your switch is accessible via Telnet (TCP port 23), I recommend to secure your remote sessions by configuring SSH access (TCP port 22). Detailed instructions on how to do this are available in here.
Step 4. Create VLANs
Next, create a VLAN for each department and assign serial numbers and names to them:

Each switch has Vlan 1 as a default one. It will be used for remote control of the switch.
You can check the current VLAN configuration by issuing the "show vlan" command:

Make sure that all defined networks are in your list.
Step 5. Binding Vlans and ports
The next step is to create a correlation between a switch ports and VLANs. The switch we use for this example has 24 Gigabit Ethernet ports. Let’s split them as follows:

6 for administration network (Vlan 100)
12 for sales department (Vlan 10)
6 for accounting department (Vlan20)

It would be great to add description strings for each interface . This is a text field which doesn’t affect any other settings.

Then, ports will be shown next to each Vlan. The result of sh vlan command should be similar to this:

By performing the above steps, we are dividing one physical switch into 4 logical switches (VLAN 1, VLAN 10, VLAN 20 and VLAN 100). Starting from this moment, the communication will be carried out only(!) between the ports that belongs to the same VLAN.

From this moment on, the workstations connected to ports that belong to different VLANs will not be able to send traffic to each other, even if they have IP addresses from the same subnet.
Step 6. Routing
In order for different VLANs to be able to communicate with each other, we need to create Layer 3 virtual interfaces for each VLAN:

On most current versions of IOS, the command "ip routing" is not necessary, because packet routing is turned on by default.
For comparison: on a Layer 2 switch mentioned in this article, you can create only one Layer 3 interface on VLAN 1 and use it only for remote access to the device. This is the reason that scenario requires a Cisco 2811 router in order to ensure routing between the various subnets.
As a result of following this set of instructions, all workstations should be able to communicate workstations in all other VLANs (after being connected to the appropriate ports of the switch). The accessibility should be checked using the ping command from the command line of the workstations.

Don't forget to save the configuration on all devices with the "write" or "copy run start" commands. Otherwise you will lose all your configuration changes after a reload.

This article was written by Alexey Yurchenko
Back to Table of contents

In everyday work, it’s often necessary to determine the switch and port a user or device is connected to. To do it, you don’t have to look for it visually. All you need is to know its MAC address.
The point is that each switch stores information about all MAC addresses that showed at least any network activity in the last few minutes. Your task is to use this information wisely.
So, let’s say you need to find the switch port a user John is connected to. It’s known that the IP address of his computer is 192.168.10.100

There are two possible ways of how you can determine the MAC address:

To execute the ipconfig /all command in the command line on the user’s computer

Or

To learn the MAC address remotely if you know the user’s computer IP address. It’s possible if you have access to a Cisco router or Cisco ASA firewall which is the default host gateway. The ARP table on these devices will contain the compliance of the MAC and IP addresses.

For searching, use the sh arp | inc x.x.x.x command, where x.x.x.x is the IP of the host we need.

As we see, the device with the 192.168.10.100 IP address has the 78ac.c0bb.74f2 MAC address and is located in VLAN 10.
Having determined the device’s MAC address, you can keep on searching for its direct location on the switch.
The show mac address-table command (it can sometimes be written with an additional hyphen instead of a space, like this: show mac—address-table) shows the MAC address table of all active devices that are connected to the switch.

Usually, there are a large number of records shown at this table. For more convenience, you can filter the necessary МАС address. Usually, four last symbols will be enough. In our case, search for the 78ac.c0bb.74f2 MAC address looks so:

The output line shows that the host is located in VLAN 10 and is connected to a port of the Gigabitethernet 0/1 switch.

If you have a small office and all network is organized only using one switch, your search is finished. But if there are several switches in the network, it’s possible that you found not the final one. Sometimes, another switch is connected to the found port of the current switch. In this case, you should repeat search in the MAC addresses table of the neighboring switch.
If you have several switches in your office, use the sh cdp neighbors command to determine the name and address for running the neighbor switch. The command will show you names and related ports of all the Cisco switches that are connected to the current switch. The sh cdp neighborsdetail command will additionally show the IP addresses for controlling the neighbor switches.

Device ID (SW-DELTACONFIG-2) – the name of the neighbor device
Local Intrfce (Gig 0/1) – the local interface where the neighbor switch is connected to
Port ID (Gig 0/18) – the interface of the neighbor switch.
Now you should connect to the neighbor switch SW-DELTACONFIG-2 with the running address 192.168.1.202 and find the necessary MAC address there.

With proper skill, this method will allow you to find hosts in a network of any size in no more than a couple of minutes without evenhttps:// away from your workplace.

This article was written by Alexey Yurchenko
Back to Table of contents

Let’s consider the simplest case when you have to hook up 3 departments of a company to different logical networks (Vlans) using one access layer switch Cisco 2960 (Sometimes they are called switches of the second layer of OSI model).

For example we need to organize these networks (Vlan):

Sales department (192.168.10.0 255.255.255.0)
Accounting department (192.168.20.0 255.255.255.0)
Administrators (192.168.100.0 255.255.255.0)
Special network for managing the network equipment (192.168.1.0 255.255.255.0)

Video version of this article

Just in case:
2nd layer devices are able to transmit within a certain network and perform transmission based on information about the MAC addresses (eg: within the network 192.168.0.0 /24).

3rd layer devices (eg: Cisco 3560 switch) are able to route network traffic based on information about ip addresses and transfer them between different networks (eg: between 192.168.1.0 /24 network and 192.168.2.0 /24 network).
Step 0: Reset all settings
(Do it only on new or test devices! This leads to complete removal of existing configuration)

After removing a new switch out of the box, use the console cable to connect to the switch and clear all it's current configuration by going to the privileged mode (#) and using the command write erase (details about the configuration of Cisco equipment can be found here).

The switch will reboot within 3 minutes and initial configuration dialog will appear. Type "no" and move to next step.
--- System Configuration Dialog ---
At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Would you like to enter the initial configuration dialog? [yes/no]:
Step 1: pick a name for your switch
Assign a name to the switch SW-DELTACONFIG-1.(SW – abbreviation SWitch). Just go to configuration mode (conf t) and type the following commands:

So, the device name changed from the «Switch» to «SW-DELTACONFIG-1».

Step 2: Customizing the management interface
Let’s customize our interface for managing the switch. By default it’s Vlan 1. You should assign an ip address of the interface and activate it by command no shutdown.

From now your switch will be available under the ip addess 192.168.1.11
Step 3: User authentication
Then, we have to configure authentication to access the device. Set password to access the privileged mode (the # sign next to device name), and create a user account with password for remote connection.

Setting a password to access the privileged mode #

Creating a user account for remote connection and a password

Enabling authentication using the local database of usernames and passwords

To check the availability of enable mode (#) after the input of these commands, exit all configuration modes (press exit or Q in each mode or use the combination of keys Ctrl+Z). You should see the initial mode on your screen (denoted by symbol >). Try to re-enter the privileged mode (denoted by symbol #). For password request – type the one you’ve chosen before.

If you did it right, you will see the following text:

To check the remote access, run the workstation's command line and then type telnet 192.168.1.11. You should see a dialog with username and password request.

After confirming that the device is accessible via Telnet, I highly recommend setting up secure access via SSH. See the instruction in this article.
Step 4: Creating a Vlan
Let’s create a Vlan for each department and assign serial numbers and names to them.

Each switch has Vlan 1 as a default one. It will be used for remote control.

To check the current Vlan settings, type sh vlan command:

Make sure that all networks are in your list.
Step 5: Binding Vlans and ports
Assign the switch access ports to your Vlan's. For example, switch has 24 FastEthernet ports and 2 Gigabit Ethernet ports. For users connection only Fast Ethernet will be used.

Let’s split them as follows:

6 for administration network (Vlan 100)
12 for sales department (Vlan 10)
6 for accounting department (Vlan20)

It would be great to add description strings for each interface . This is a text field which doesn’t affect any other settings.

Then, ports will be shown next to each Vlan. The result of sh vlan command should be similar to this:

By previous commands we shared one physical switch to 4 logical ones (Vlan 1, Vlan 10, Vlan 20 and Vlan 100).

Important!
Connections between hosts will be able only if their ports on the switch belongs to the same Vlan.
Hosts that are connected to ports belonging to different Vlans can’t communicate with each other even if correct ip addressing will be configured.

You need a router connected to the switch using a trunk port in order to that all networks could communicate with each other. All necessary information about configuration can be found in this article. The difference of trunk interface is that the transmission of each packet of traffic is marked by Vlan number. This allows the device to forward packets correctly. In the switch, port is configured like this:

If system doesn’t accept the last line, then dot1q mode is the only possible one, and goes by default.

After making all of the steps, connect two workstations to ports belonging to the same Vlan, eg with the number 100, set ip addresses 192.168.100.1 and 192.168.100.2, then use ping from one to another. A successful response means that everything works as it should.

For reference:
There are 3rd layer switches of OSI model (eg Cisco 3560) which combine functions of router (3rd layer devices) and 2nd layer switches (access layer). 3rd layer devices are used for transferring data between different networks using information about ip addresses.

The solution of a similar problem in the organization of several Vlan using this switch is shown in this article.
Important!
Don't forget to save running configuration on all Cisco devices or you will loose all the changes after reboot. Do this with the command "write" or "copy run start"
FW-DELTACONFIG-1#write
Building configuration...
[OK]

This article was written by Alexey Yurchenko
Back to Table of contents