Important Points for the exam

>UDLD: works only for fiber optic ports. It helps to check if there is any broken links between switches.
     #conf t
     #udld enable

> In the trunk the native vlan frames travel with out tagging. default all ports on a switch belong to VLAN1(native vlan)

> Tag is nothing but vlan identifier

> ISL and 802.1q can identify layer 2 frames

>ISL adds a 26-byte headerand a 4-byte trailer to the frame. The source VLAN is identified with a 10-bit VLAN ID field in the header. The trailer contains a cyclic redundancy check (CRC) value to ensure the data integrity of the new encapsulated frame

>BPDU: Bridge Protocol data unit. These are unique frames exchanged between switches to identify and topology changes. These messages are used to create a loop free switch network. The BPDU has following items:

     a> Root Bridge ID : Priority Number + MAC address
     b> Root Bridge Path Cost
     c> Sender Bridge ID: Priority Number+MAC address
     d> Port ID: Determines the port from which these BPDU are sent
     e> 8 Flags (1st flag determines there is a change in the network, last flag determies topology change ack)
     f> other feilds like forward delay, max age and Hello timers

> Spanning Tree Protocol: is used to optimize switch networks by dropping trees on redundant paths. The algo uses BPDU to determine loop free path in the network. Below is the process on how it works

1.  each switch in the network considers it self as Root Bridge (the default priority is 32768)
2.  If switch receives any BPDU it compares the Root Bridge ID with its own database. If its better (checks the priority first if its a tie then matches the MAC address. Remember the lower the better) with low Root Bridge ID then it deletes already stored and adds root bridge to its database.
3.  Once the root bridge is determined next step is to find the lowest cost path to reach it or finding the root port. Lower the cost of the path the better is the link ( 10 Mbps cost is 100 and 1Gbps is 4). So each switch should have atleast one root port. The Root Bridge will never have root ports.
4.  If a switch has multiple connections through different switches with equal cost then it will chooe path via the switch with Lower bridge ID(as lower is better).
5.  Once root port is determined now its time to find the designated ports and the blocked ports.
6.  All the ports connected to end devices will be designated along with those ports connected to the root ports of the other switches.
7.  Important: Blocked ports. How to determine them : check examples in the below link http://ccnpswitch.blogspot.com/2011_08_01_archive.html

>If the bridge piority is same then the MAC address usually resolves the tie.


>STP port Status :  








Process                               blocking        listening       learning      forwarding       disable


Receives& Process              Yes                    Yes               Yes              Yes                    No
BPDU

Forward Frames rcvd            No                     No              No               Yes                    No  
on interface


Forward data frames             No                     No               No                Yes                   No
received from another
interface

Learn MAC address             No                       No                Yes              Yes               No





> Port

> Root Guard is mainly for changing designated port to" Inconsistent Blocked port" if the root receives any superior BPDU.

> Root Guard: It is interface configuration command like

#interface f0/2 - 4    --->here this f0/2, f0/3, f0/4 are connected to different switches
#spanning-tree guard root

Private VLANs

How to create Private Vlans. Below are the steps I follow:

1> create a map of how your network is and the interfaces in the port modes
2> create primary and sub vlans and associate sub-vlans to primary vlan
3> add interfaces to either isolated or community
4> finally add the promiscuous port and map private-vlans which can reach this promiscuous port.

1>Creating the map
Primary vlan: 200
f4/27    Router--> promiscuous port
f4/26FTP--> Isolated   vlan 210
f4/24 and f4/25  WWW and sql-->community   vlan 205

2.a> Creating vlan and sub vlans
conf t
vtp mode transparent
vlan 200
private-vlan primary
exit
vlan 205
private-vlan community
exit
vlan 210
private-vlan isolated
exit
================
2.b> Associating the sub-vlans to Primary vlan


associating 205 and 210 to vlan 100

vlan 200
private-vlan association 205,210

===============
show vlan private-vlan type
============

configuring fast ethernet ports now

3> add ports to Private vlans and to modes

int fa4/24
switchport mode private-vlan host
switchport private-vlan host association 200 205

4> creating promiscuous port and map private-vlans which can reach this promiscuous port

int fa4/27
switchport mode private-vlan promiscuous
switchport private-vlan mapping 200 205,210