Basic switching concepts and configuration

Basic Switching concepts and configuration
CCNA Routing and Switching Complete Review Guide
Eng. Mohamed Selim

Switch Configuration 2 - Security

Half-and Full-Duplex Ethernet
Half-duplex Ethernet is defined in the original IEEE 802.3 Ethernet specification, which differs a bit from how Cisco describes things. Cisco says Ethernet
uses only one wire pair with a digital signal running in both directions on the wire.
Half-duplex also uses the CSMA/CD protocol to help prevent collisions and to permit retransmitting if one occurs. If a hub is attached to a switch, it must
operate in half-duplex mode because the end stations must be able to detect collisions. Figure 2.1 shows a network with four hosts connected to a hub.

The problem here is that we can only run half-duplex, and if two hosts communicate at the same time, there will be a collision. Also, half-duplex Ethernet is
only about 30 to 40 percent efficient because a large 100Base-T network will usually only give you 30 to 40 Mbps, at most, due to overhead of the CSMA/CD
protocol.
Full-duplex Ethernet uses two pairs of wires at the same time instead of a single wire pair like half-duplex. And full-duplex uses a point-to-point connection
between the transmitter of the transmitting device and the receiver of the receiving device. This means that full-duplex data transfers happen a lot faster
when compared to half-duplex transfers. Also, because the transmitted data is sent on a different set of wires than the received data, collisions won't happen.
Figure 2.2 shows four hosts connected to a switch, plus a hub. And by the way, definitely try not to use hubs if you can help it!

Theoretically, all hosts connected to the switch in Figure 2.2 can communicate at the same time because they can run full-duplex. Just keep in mind that the
switch port connecting to the hub as well as the hosts connecting to that hub must run at half-duplex.
The reason you don't need to worry about collisions is that now it's like a freeway with multiple lanes instead of the single-lane road provided by half-duplex.
Full-duplex Ethernet is supposed to offer 100 percent efficiency in both directions.
You can use full-duplex Ethernet in at least the following six situations:
● With a connection from a switch to a host
● With a connection from a switch to a switch
● With a connection from a host to a host
● With a connection from a switch to a router
● With a connection from a router to a router
● With a connection from a router to a host
Note Full-duplex Ethernet requires a point-to-point connection when only two nodes are present. You can run full-duplex with just about any device
except a hub.
When a full-duplex Ethernet port is powered on, it first connects to the remote end and then negotiates with the other end of the Fast Ethernet link. This is
called an autodetect mechanism. This mechanism first decides on the exchange capability, which means it checks to see if it can run at 10, 100, or even
1,000 Mbps. It then checks to see if it can run full-duplex, and if it can't, it will run half-duplex.
Note Remember that half-duplex Ethernet shares a collision domain and provides a lower effective throughput than full-duplex Ethernet, which typically
has a private per-port collision domain plus a higher effective throughput.

Last, remember these important points:
● There are no collisions in full-duplex mode.
● A dedicated switch port is required for each full-duplex node.
● The host network card and the switch port must be capable of operating in full-duplex mode.
● The default behavior of 10Base-T and 100Base-T hosts is 10 Mbps half-duplex if the autodetect mechanism fails, so it is always good
practice to set the speed and duplex of each port on a switch if you can.

Configure and Verify Initial Switch Configuration Including Remote Access Management
In the following sections, going to show you how to configure a Cisco IOS device using the Cisco IOS command-line interface (CLI) and some command
verifications.
Starting with a basic IOS switch to begin building the network we'll use throughout this chapter for configuration examples.
Cisco IOS Commands to Perform Basic Switch Setup
When you first bring up a Cisco IOS device, it will run a power-on self-test—a POST. Upon passing that, the machine will look for and then load the Cisco
IOS from flash memory if an IOS file is present, and then it will expand it into RAM. As you probably know, flash memory is electronically erasable
programmable read-only memory—EEPROM. The next step is for the IOS to locate and load a valid configuration known as the startup-config that will be
stored in nonvolatile RAM (NVRAM).
Once the IOS is loaded and up and running, the startup-config will be copied from NVRAM into RAM and from then on referred to as the running-config.
But if a valid startup-config isn't found in NVRAM, your switch will enter setup mode, giving you a step-by-step dialog to help configure some basic
parameters on it.
You can also enter setup mode at any time from the command line by typing the command setup from privileged mode, which I'll get to in a minute. Setup
mode only covers some basic commands and generally isn't really all that helpful. Here's an example:

Would you like to enter the initial configuration dialog? [yes/no]: y
At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Basic management setup configures only enough connectivity
for management of the system, extended setup will ask you
to configure each interface on the system
Would you like to enter basic management setup? [yes/no]: y
Configuring global parameters:
Enter host name [Switch]: Ctrl+C
Configuration aborted, no changes made.
Highly recommend going through setup mode once and then never again because you should always use the CLI instead!

Entering the CLI
After the interface status messages appear and you press Enter, the Switch> prompt will pop up. This is called user exec mode, or user mode for short, and
although it's mostly used to view statistics, it is also a stepping stone along the way to logging in to privileged exec mode, called privileged mode for short.
You can view and change the configuration of a Cisco switch only while in privileged mode, and you enter it via the enable command like this:
Switch>enable
Switch#
The Switch# prompt signals that you're in privileged mode, where you can both view and change the switch configuration. You can go back from privileged mode
into user mode by using the disable command:
Switch#disable
Switch>
You can type logout from either mode to exit the console:
Switch>logout
Switch con0 is now available
Press RETURN to get started.
Next, I'll show how to perform some basic administrative configurations.

Overview of IOS Modes
To configure from a CLI, you can make global changes to the switch or device by typing configure terminal, or just config t. This will get you into global
configuration mode where you can make changes to the running-config. Commands run from global configuration mode are predictably referred to as global
commands, and they are typically set only once and affect the entire switch or device.
Type config from the privileged-mode prompt and then press Enter to opt for the default of terminal, like this:
Switch#config
Configuring from terminal, memory, or network [terminal]? [press enter]
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#
At this point, you make changes that affect the switch/device as a whole (globally), hence the term global configuration mode. For instance, to change the
running-config—the current configuration running in dynamic RAM (DRAM)—use the configure terminal command, as I just demonstrated.
CLI Prompts
Let's explore the different prompts you'll encounter when configuring a switch or router.
Note
It's not important that you understand exactly what each of these command prompts accomplishes just yet. For now, relax and focus on just becoming
familiar with the different prompts available.

Interfaces
To make changes to an interface, use the interface command from global configuration mode:
Notice that the prompt changed to Switch(config-if)#? This tells you that you're in interface configuration mode. And wouldn't it be nice if
the prompt also gave you an indication of what interface you were configuring? Well, at least for now we'll have to live without the prompt
information, because it doesn't. But it should already be clear to you that you really need to pay attention when configuring an IOS device!

Notice that the prompt changed to Switch(config-if)#? This tells you that you're in interface configuration mode. And wouldn't it be nice if
the prompt also gave you an indication of what interface you were configuring? Well, at least for now we'll have to live without the prompt
information, because it doesn't. But it should already be clear to you that you really need to pay attention when configuring an IOS device!
The line console 0 command is a global command, and sometimes you'll also hear people refer to global commands as major
commands. In this example, any command typed from the (config-line) prompt is known as a subcommand.
Access List Configurations
To configure a standard named access list, you'll need to get to the prompt Switch(config-std-nacl)#:
What you see here is a typical standard named ACL prompt. There are various ways to configure access lists, and the prompts are only
slightly different from this particular example.

Routing Protocol Configurations
I need to point out that we don't use routing or routing protocols on 2960 switches, but we can and will use them on 3560 switches. Here is an example of
configuring routing on a layer 3 switch:
Did you notice that the prompt changed to Switch(config-router)#? To make sure you achieve the objectives specific to the Cisco exam
and this book, I'll configure RIPv2, OSPF, and OSPFv3.
Editing and Help Features
The Cisco advanced editing features can also help you configure your router. If you type a question mark (?) at any prompt, you'll be given a list of all the
commands available from that prompt:

And if this is not enough information for you, you can press the spacebar to get another whole page of information, or you can press Enter to go one
command at a time. You can also press Q, or any other key for that matter, to quit and return to the prompt. Notice that I typed a question mark (?) at the
more prompt and it told me what my options were from that prompt.
Here's a shortcut: to find commands that start with a certain letter, use the letter and the question mark with no space between them, like this:
By typing c?, I got a response listing all the commands that start with c. Also notice that the Switch#c prompt reappears after the list of commands is
displayed. This can be really helpful when you happen to be working with long commands but you're short on patience and still need the next possible one. It
would get old fast if you actually had to retype the entire command every time you used a question mark!
So with that, let's find the next command in a string by typing the first command and then a question mark:

Administrative Configurations
Even though the following sections aren't critical to making a router or switch work on a network, they're still really important.
You can configure the following administrative functions on a router and switch:
● Hostnames
● Banners
● Passwords
● Interface descriptions
Remember, none of these will make your routers or switches work better or faster, but trust me, your life will be a whole lot better if you just take the time to
set these configurations on each of your network devices.
Hostnames
We use the hostname command to set the identity of the router. This is only locally significant, meaning it doesn't affect how the router performs name
lookups or how the device actually works on the internetwork. But the hostname is still important because it's often used for authentication in many wide area
networks (WANs). Here's an example:
Switch#config t
Switch(config)#hostname Todd
Todd(config)#

Banners
A very good reason for having a banner is to give any and all who dare attempt to telnet or sneak into your internetwork a little security notice. And they're
very cool because you can create and customize them so that they'll greet anyone who shows up on the router with exactly the information you want them to
have!
Here are the three types of banners you need to be sure you're familiar with:
● Exec process creation banner
● Login banner
● Message of the day banner
And you can see them all illustrated in the following code:
Message of the day (MOTD) banners are the most widely used banners because they give a message to anyone connecting to the router via Telnet or an
auxiliary port or even through a console port as seen here:

You can set a banner on one line like this:
Todd(config)#banner motd x Unauthorized access prohibited! x
As mentioned earlier, there are a couple of other types of banners you should be aware of:
Exec banner You can configure a line-activation (exec) banner to be displayed when EXEC processes such as a line activation or an incoming connection
to a VTY line have been created. Simply initiating a user exec session through a console port will activate the exec banner.
Login banner You can configure a login banner for display on all connected terminals. It will show up after the MOTD banner but before the login prompts.
This login banner can't be disabled on a per-line basis, so to globally disable it you've got to delete it with the no banner login command.
Here's what a login banner output looks like:

The previous login banner should look pretty familiar to anyone who's ever logged into an ISR router because it's the banner Cisco has in the default
configuration for its ISR routers.
Note
Remember that the login banner is displayed before the login prompts and after the MOTD banner.

Setting Passwords
There are five passwords you'll need to secure your Cisco routers: console, auxiliary, Telnet (VTY), enable, and enable secret. The enable secret and enable
password are the ones used to set the password for securing privileged mode. Once the enable commands are set, users will be prompted for a password.
The other three are used to configure a password when user mode is accessed through the console port, through the auxiliary port, or via Telnet.
Let's take a look at each of these now.
Enable Passwords
You set the enable passwords from global configuration mode like this:
Todd(config)#enable ?
last-resort Define enable action if no TACACS servers
respond
password Assign the privileged level password
secret Assign the privileged level secret
use-tacacs Use TACACS to check enable passwords

Here's an example that shows how to set the enable passwords:
Todd(config)#enable secret todd
Todd(config)#enable password todd
The enable password you have chosen is the same as your
enable secret. This is not recommended. Re-enter the
enable password.
If you try to set the enable secret and enable passwords the same, the router will give you a polite warning to change the second password. Make a note to
yourself that if there aren't any old legacy routers involved, you don't even bother to use the enable password!
User-mode passwords are assigned via the line command like this:
Todd(config)#line ?
<0-16> First Line number
console Primary terminal line
vty Virtual terminal

These two lines are especially important for the exam objectives:
console Sets a console user-mode password.
vty Sets a Telnet password on the router. If this password isn't set, then by default, Telnet can't be used.
To configure user-mode passwords, choose the line you want and configure it using the login command to make the switch prompt for
authentication. Let's focus on the configuration of individual lines now.
Console Password
We set the console password with the line console 0 command, but look at what happened when I tried to type line console ? from the
(config-line)# prompt—I received an error! Here's the example:
Todd(config-line)#line console ?
% Unrecognized command
Todd(config-line)#exit
Todd(config)#line console ?
Todd(config-line)#password console
Todd(config-line)#login

You can still type line console 0 and that will be accepted, but the help screens just don't work from that prompt. Type exit to go back one level, and
you'll find that your help screens now work.
Because there's only one console port, I can only choose line console 0. You can set all your line passwords to the same password, but doing this isn't
exactly a brilliant security move!
And it's also important to remember to apply the login command or the console port won't prompt for authentication. The way Cisco has this process set up
means you can't set the login command before a password is set on a line because if you set it but don't then set a password, that line won't be usable.
You'll actually get prompted for a password that doesn't exist, so Cisco's method isn't just a hassle, it makes sense and is a feature after all!
Okay, there are a few other important commands you need to know regarding the console port.
For one, the exec-timeout 0 0 command sets the time-out for the console EXEC session to zero, ensuring that it never times out. The default time-out is
10 minutes.
Logging synchronous is such a cool command that it should be a default, but it's not. It's great because it's the antidote for those annoying console
messages that disrupt the input you're trying to type. The messages will still pop up, but at least you get returned to your router prompt without your input
being interrupted! This makes your input messages oh so much easier to read!
Here's an example of how to configure both commands:
Note You can set the console to go from never timing out (0 0) to timing out in 35,791 minutes and 2,147,483 seconds. Remember that the
default is 10 minutes.

Telnet Password
To set the user-mode password for Telnet access into the router or switch, use the line vty command. IOS switches typically have 16 lines, but routers
running the Enterprise edition have considerably more. The best way to find out how many lines you have is to use that handy question mark like this:
Todd(config-line)#line vty 0 ?
% Unrecognized command
Todd(config-line)#exit
Todd(config)#line vty 0 ?
<1-15> Last Line number
<cr>
Todd(config)#line vty 0 15
Todd(config-line)#password telnet
This output clearly shows that you cannot get help from your (config-line)# prompt. You must go back to global config mode in order to use the question
mark (?).

So what will happen if you try to telnet into a device that doesn't have a VTY password set? You'll receive an error saying the connection has been refused
because the password isn't set. So, if you telnet into a switch and receive a message like this one that I got from SwitchB, it means the switch doesn't have
the VTY password set:
Todd#telnet SwitchB
Trying SwitchB (10.0.0.1)…Open
Password required, but none set
[Connection to SwitchB closed by foreign host]
Todd#
But you can still get around this and tell the switch to allow Telnet connections without a password by using the no login command:
SwitchB(config-line)#line vty 0 15
SwitchB(config-line)#no login
Warning I definitely do not recommend using the no login command to allow Telnet connections without a password, unless you're in a testing or classroom
environment. In a production network, always set your VTY password!
After your IOS devices are configured with an IP address, you can use the Telnet program to configure and check your routers instead of having to use a
console cable. You can use the Telnet program by typing telnet from any command prompt (DOS or Cisco).

Auxiliary Password
To configure the auxiliary password on a router, go into global configuration mode and type line aux ?. And by the way, you won't find these ports on a
switch. This output shows that you only get a choice of 0-0, which is because there's only one port:
Todd#config t
Todd(config)#line aux ?
Todd(config)#line aux 0
% Login disabled on line 1, until 'password' is set
Todd(config-line)#password aux

Verify Network Status and Switch Operation Using Basic Utilities Such as Ping, Telnet, and SSH
You can use the ping and traceroute commands to test connectivity to remote devices, and both of them can be used with many protocols, not just IP. But
don't forget that the show ip route command is a great troubleshooting command for verifying your routing table and the show interfaces command will
reveal the status of each interface to you.
I'm not going to get into the show interfaces commands here, but in addition to ping and traceroute, I am going to go over both the debug command and
the show processes command that come in very handy when you need to troubleshoot a router.
ping Command
So far, you've seen lots of examples of pinging devices to test IP connectivity and name resolution using the DNS server. To see all the different protocols
that you can use with the ping program, type ping ?:
SW-1#ping ?
WORD Ping destination address or hostname
clns CLNS echo
ip IP echo
ipv6 IPv6 echo
tag Tag encapsulated IP echo
<cr>

The ping output displays the minimum, average, and maximum times it takes for a ping packet to find a specified system and return. Here's an example:
SW-1#ping SW-3
Translating "SW-3"…domain server (4.4.4.4) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.128.8, timeout is
2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max
= 28/31/32 ms
This output tells us that the DNS server was used to resolve the name and the device was pinged in a minimum of 28 ms (milliseconds), an average of 31
ms, and up to 32 ms. This network has some latency!
Note
The ping command can be used in user and privileged mode but not configuration mode!

show processes Command
The show processes command (or show processes cpu) is a good tool for determining a given router's CPU utilization. Plus, it'll give you a list of active
processes along with their corresponding process ID, priority, scheduler test (status), CPU time used, number of times invoked, and so on.
So basically, the output from the show processes command reveals that our router is happily able to process debugging commands without being
overloaded—nice!
Note To see how to use Telnet and SSH to verify a network, please see the section "Configure and Verify Initial Switch Configuration Including Remote
Access Management."

IP on the Switch
• By default, Cisco switches are not configured with IP addresses
– Generally speaking, a switch does not require an IP address
• Because switches operate mainly on Layer 2
• You may want to configure an IP address for your
switch so that you can manage it over the network
• Also, you may need to configure an IP address for
your switch if you want to implement VLANs on
your network

Configuring the duplex mode
You would use the following command to set the
duplex mode:
• Rm410HL#configure terminal
• Rm410HL(config)#interface f0/24
• Rm410HL(config-if)#duplex full

Securing Switch Ports
You can choose from several degrees of security on a switch
– First, you can configure a permanent MAC address for a specific port on your switch
– Second, you could define a static MAC address entry into your switching table
• Which maps a restricted communication path between two ports
• To configure port security, you first must enter the interface configuration mode
You can display several options by typing the following command:
– Rm410HL(config-if)#switchport portsecurity?
– Options include aging, mac-address, maximum,and violation
• To turn switchport security off, use:
– Rm410HL(config-if)#no switchport portsecurity
• To clear the settings to include erasing the static MAC addresses, use the clear command:
– Rm410HL(config-if)#clear port-security

Basic switching concepts and configuration

Exam Essentials
Differentiate half-duplex and full-duplex communication and define the requirements to utilize each method. Full-duplex Ethernet
uses two pairs of wires at the same time instead of one wire pair like half-duplex. Full-duplex allows for sending and receiving at the same
time, using different wires to eliminate collisions, while half-duplex can send or receive but not at the same time and still can suffer collisions.
For full-duplex, the devices at both ends of the cable must be capable of and configured to perform full-duplex.
Recognize additional prompts available and describe their use. Additional modes are reached via the global configuration prompt,
routername(config)#, and their prompts include interface, router(config-if)#, for making interface settings; line configuration mode,
router(config-line)#, used to set passwords and make other settings to various connection methods; and lastly, routing protocol modes
for various routing protocols, such as router(config-router)#, used to enable and configure routing protocols.
Access and utilize editing and help features. Make use of typing a question mark at the end of commands for help in using the
commands. Additionally, understand how to filter command help with the same question mark and letters. Use the command history to
retrieve commands previously utilized without retyping. Understand the meaning of the caret when an incorrect command is rejected. Finally,
identify useful hotkey combinations.
Know how to set the hostname of a router. The command sequence to set the hostname of a router is as follows:
enable
config t
hostname Todd
Describe the function of the ping command. Packet Internet Groper (Ping) uses ICMP echo requests and ICMP echo replies to verify an
active IP address on a network.

Basic switching concepts and configuration

More Related Content

What's hot (20)

Similar to Basic switching concepts and configuration (20)

Recently uploaded (20)

Basic switching concepts and configuration