Sunday, 20 May 2012

STP's Bridge ID

STP, RSTP, MST, PVST all share one common thing which is almost never discusses and rarely documented. The priority value in the BID.

MST - Multiple spanning-tree.
I had to dig to find stuff on this, there isn't a lot of documentation around for MST. A good video that explains the basics can be found here: http://youtu.be/U2CNahYexlg


I'm just off to configure this on my rack and see how things go. 
But back the main topic, STP's BID.
Okay so we know the BID of a switch is the combination of the priority value and the mac address. A normal BID usually looks like this:



The zero is the vlan number, aka system-extended-id used in pvst and rapid-pvst
We’ll come back to that shortly.

We also know how this combination works to determine the root STP bridge:




  1. Lowest priority wins
  2. If priorities are equal then lowest MAC addy wins

But where did this default priority come from? And why does it have to be 32768? A bit weird isn’t it? I didn’t pay much attention to it before, I accepted it for what it was, accepted that it must be for some reason but didn’t care too much. But it really annoyed me when I started tweaking PVST to do load balancing.

In the below figure the following lines were entered on switch A and switch B

Switch-A (config) # spanning-tree vlan 20 root primary
Switch-B (config) # spanning-tree vlan 20 root secondary

Switch-B (config) # spanning-tree vlan 10 root primary
Switch-B (config) # spanning-tree vlan 10 root secondary





Load balancing done for vlan 10 and 20 – beautiful

But as I said before, the priority value is so strange, why the random number, or is it not random?
After some reading I learned back in the old days before PVST the priority value was a flat decimal of 65536, the standard 16 bit number that’s applied to almost everything networking related

PVST uses 12 bits for the system-extended-id leaving 4 bits for the priority value, why?
Well that’s how PVST’s automation works, you see, by stealing 12 bits from the 16 bit value of 65536 we’re able to assign 4096 vlans per priority group… AHHHH so now you see why the maximum vlan range is 4096. Now if you’re wondering what I mean by priority group, I mean the remaining 4 bits.

Confused? Lol

Okay first jump on a switch and enter this:

Switch (config) # spanning-tree vlan 1 priority ?

The output shows you can only go up in increments of 4096

4096
8192
16384
32768

Notice that’s 4 numbers,
Notice the lower number is the usual 4096 seen in vlan configurations
Notice the 32768 is the default priority value for spanning-tree

So it’s not random eh?

This means, as per our diagram, the manual setting of root primary and root secondary respectively which results in 28672 and 24576 must be a calculation of 4096 and yes it is.
They both sit at the power of 7 and the power of 6 respectively


32768 = 8 squared
28673 = 7 squared
24576 = 6 squared
And so on ….

So if you look at it,

The default is 8, setting the root manually drops one increment of 4096, and setting the secondary drops another increment.

Now this explains the randomness, which I guess isn’t random
Side note: if you did your calculations you’d realize the maximum increment is 15 which means you can only set 15 manual spanning-tree bridges in your switch broadcast domain via the priority value.

I suppose you could change MAC addresses, but that’s a bit extreme for STP I would think… what are the chances of 15 bridges failing, and even then if 15 bridges fail I’m sure you wouldn’t give a rats ass about vlan traffic flow, at that point.

Any questions are welcomed

Cheers

Monday, 7 May 2012

NAT / PAT

What a horror!
Encountered a nasty one with Network Address Translation Overload, took me a while to figure this one out.

NAT Overload

The Scenario:
WWW : 209.65.200.241/29
ISP : 209.65.200.254 /29
       : 209.65.200.226 /30 
R1  : 209.65.200.225 /30
       : 10.1.1.1 /30 
R2  : 10.1.1.2 /30
----------------------------------------------------------------------------------------------------------------------------


As you can see, R1 has a public ip address to route on the internet and a private ip address to communicate with the internal network. As we all know RFC 1918 address aren't permitted on the internet so two things needs to be done.

1) NAT/PAT
2) An access list to restrict RFC1918

Here's the config on R1

        interface Serial1/0
         description : FRAME INTERFACE
         no ip address
         ip nat inside
         encapsulation frame-relay
         serial restart-delay 0
         no frame-relay inverse-arp
        !
        interface Serial1/0.12 point-to-point
         description : Link to R2
         ip address 10.1.1.1 255.255.255.252
         ip nat inside
         frame-relay interface-dlci 101
        !
        interface Serial1/1
         description : Link to ISP
         ip address 209.65.200.225 255.255.255.252
         ip access-group 192 out
         ip nat outside
         encapsulation ppp
         serial restart-delay 0
         no cdp enable
         ppp authentication chap

ip nat source list 10 interface Serial1/1 overload
!
access-list 10 permit 10.0.0.0 0.7.255.255 log
access-list 192 deny   ip 10.0.0.0 0.255.255.255 any log
access-list 192 deny   ip 172.16.0.0 0.15.255.255 any log
access-list 192 deny   ip 192.168.0.0 0.0.255.255 any log
 

 So the above config should work right? or so believed
access group blocks RFC1918 addresses out to the internet and NAT overload set for internal clients. It took me hours to figure out what was wrong, combed google, read the cisco NAT / PAT config guide over and over, checked my notes, etc. I started to think maybe this is a bug in the IOS or something.

After clearing my head and troubleshooting from the bottom up, i noticed there were no log hits on the access-list 10 which means traffic wasn't being checked. This is after disabling the ip access-group 192 out on the serial interface to ISP

Turned on ICMP debug on ISP router and to my not-so-supprise i saw the private ip addresses, knociing at the ISP router's door

So, what does NAT and ACCESSLISTS have in common?
Why would the router route the traffic and not include NAT and ACCESSLISTS in the equation?

Answer = our good old friend CEF (Cisco Express Forwarding)
CEF is brilliant for bypassing the route processor and forwarding frames at wirespeed via hardware

So i quickly jumped to my console and typed "no ip route-cache"

        interface Serial1/1
         description : Link to ISP
         ip address 209.65.200.225 255.255.255.252
         ip access-group 192 out
         ip nat enable
         no ip route-cache
         no ip route-cache cef
         encapsulation ppp
         serial restart-delay 0
         no cdp enable
         ppp authentication chap

And NAT in worked beautifully.
I also learned the old way of using

"ip nat inside source list ...."
"ip nat inside"
"ip nat outside"

can be replaced with

"ip nat enable"
"ip nat source list...."

https://learningnetwork.cisco.com/thread/26212

So there it is folks

Introduction

Spent the last 10 years in the server world with some network knowledge and like most server engineers / MCSE / MCITP folk, i thought i knew it all. Yes sir i can ping and i can sub-net and i can do port forwarding, i even know all the well known ports, oh by the way did i tell you i can tracert -d and pathping? and don't make me buss out the angry-ip-scanner.
So i decided to tap into add a few Cisco certifications to the list, namely CCNA, ah yes the feared CCNA.
Obtained it in 2009 but man did it nearly skin me alive. I didn't know networking, i knew jack shit.
3 years after, looking back it, how did i ever think that was hard? and even more important, why did i stay in the server / Microsoft world for so long? Networking is so awesome!
Anyways, here i am, CCNP finishing up and preparing for CCIE R&S
This journey is going to be EPIC!

-------------------------------------------------------------------------------------------------------------------------

Alright so i'm finally finishing up CCNP with TSHOOT exam scheduled for June 15th and getting started the CCIE R&S track. This is going to be exciting
While searching online for information, study tips, rack equipment etc i came across many blogs from engineers pursuing their CCIE detailing what horrors they went through while studying / taking the lab, practical stuff, home labs and work experience. So why not, I might as well join the group =)