Reverse Engineering - DHCP & NetFlow

Most often than not, you will be required to reverse engineer different environments that are undocumented. I have been tasked with swapping out another 6509 for a 6509E and adding a secondary 6509E for redundancy.

One of the items I discovered that was unique to this environment was the DHCP configurations someone put in but never documented them and some NetFlow that was running but never being exported. It also was against policy for this environment.

 You will learn a lot while reverse engineering. Take for example this DHCP configuration; I have always implemented what was shown to me in Cisco books and never to the extent of what I found.  Another important lesson is to know what dependencies one configuration has to another, this is how things break if you don't over analyze. I obviously masqueraded some of the items due to security concerns and these two configurations have no dependency on each other.

DHCP CONFIG:

ip dhcp pool AP
   host 10.200.10.58 255.255.255.0
   client-identifier 0100.c0b7.2d38.07
   bootfile config.ini
   default-router 10.200.10.254
   domain-name joel.com
   option 150 ip 10.200.10.102
   lease 7

ip dhcp pool AP
   host 10.200.10.59 255.255.255.0
   client-identifier 0100.c0b7.2d37.c3
   bootfile config.ini
   default-router 10.200.10.254
   domain-name joel.com
   option 150 ip 10.200.10.102
   lease 7

Document I used to figure out what was going with this configuration:
http://www.cisco.com/en/US/docs/ios/12_1/iproute/command/reference/1rddhcp.html#wp1018363

Verfication:

6509E#show ip dhcp binding
IP address Client-ID/ Lease expiration Type
Hardware address
10.200.10.58 0100.c0b7.2d38.07 Infinite Manual
10.200.10.59 0100.c0b7.2d37.c3 Infinite Manual

NetFlow Config:

6509E#show running-config | include netflow
mls netflow interface
6509E#show run int vlan 30
Building configuration...
Current configuration : 174 bytes
!
interface Vlan30
 description AP
 ip address 10.200.10.254 255.255.255.0
 ip flow ingress
end

Document I used to figure out what was going with this configuration:
http://www.cisco.com/en/US/docs/ios/netflow/command/reference/nf_02.html#wp1012875

Verification:

6509E#show ip cache flow
-------------------------------------------------------------------------------
Displaying software-switched flow entries on the MSFC in Module 6:
IP packet size distribution (98171M total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .174 .019 .012 .007 .013 .054 .007 .002 .003 .004 .001 .016 .000 .000
    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .080 .073 .523 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
  534 active, 3562 inactive, 2284418974 added
  2945144932 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 33992 bytes
  0 active, 1024 inactive, 0 added, 0 added to flow
  0 alloc failures, 0 force free
  1 chunk, 1 chunk added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet     1685390      0.3         1    47      0.7       0.8      14.3
TCP-FTP        1258810      0.2         1    51      0.5       0.5      12.0
TCP-FTPD        282755      0.0         1    48      0.0       0.0      14.4

Vlan Access-Map and mac address access-list

How do you prevent intravlan communication? If you wanted to prevent InterVlan communications, you would create a RACL and apply it to the L3 interface. But when you want to prevent IntraVlan communications, you will need to a VACL. I will demonstrate how to create a VACL and apply it. Additionally, how you can also filter down to the mac address of a host rather than the ip address.

We will use figure 1 to visualize the configuration and once done we will have completed the following actions.

1.     Prevent PC1 from talking to PC2

2.     Prevent PC1 from talking to PC3

3.     Allow all other communication between hosts

4.     Apply VACL to Vlan 100

Figure 1

Configuration:

access-list 100 permit ip host 192.168.100.1 host 192.168.100.2
!
mac access-list extended macfilter
permit host 4055.39a8.101f host 4055.39a8.103f
!
vlan access-map Vlan_100_Filter 10
action drop
match ip address 100
!
vlan access-map Vlan_100_Filter 20
action drop
match mac address macfilter
!
vlan access-map Vlan_100_Filter 30
action forward
!
vlan filter Vlan_100_Filter vlan-list 100

Verification:

Cisco_4948E_01#show vlan filter
VLAN Map Vlan_100_Filter is filtering VLANs:
  100
Cisco_4948E_01#show vlan access-map Vlan_100_Filter
Vlan access-map "Vlan_100_Filter"  10
  Match clauses:
    ip  address: 100
  Action:
    drop
Vlan access-map "Vlan_100_Filter"  20
  Match clauses:
    mac address: macfilter
  Action:
    drop
Vlan access-map "Vlan_100_Filter"  30
  Match clauses:
  Action:
    forward

Cisco_4948E_01#show ip access-lists 100
Extended IP access list 100
    10 permit ip host 192.168.100.1 host 192.168.100.2
Cisco_4948E_01#show access-list macfilter
Extended MAC access list macfilter
    permit host 4055.39a8.101f host 4055.39a8.103f

I could of just filtered based on the ip addresses of the host rather than creating a mac acl but I wanted to demonstrate the feature. I have not seen it widely deployed.

Cisco 6509E Redundant Mode VS Combined Mode

Today while setting up a spare chassis to be used for burning in cards only, I noticed something that I never ran into.  Two out of the 8 modules that I had loaded into the chassis were showing a status of PwrDeny (See Example 1.1). We can correct this by installing higher wattage power supplies or changing the power mode from redundant to combined mode. I personally would prefer to install the higher wattage power supplies, but due to circumstances out of my control, I ended up changing the power mode to combined. Pros and Cons are below as well.

Redundant Mode:
When running in Redundant Mode, each power supply provides approximately 50% of its capacity to the chassis. In the event of a failure, the unaffected power supply will then provide 100% of its capacity and an alert will be generated. As there was enough to power the chassis ahead of time, there is no interruption to service in this configuration. This is also the default and recommended way to configure power supplies

Combined Mode:
In combined mode, each power supply provides approximately 83% of its capacity to the chassis. This allows for greater utilization of the power supplies and potentially increased PoE densities

Source: http://en.wikipedia.org/wiki/Catalyst_6500

Example 1.1

6509E_BURN_IN#show mod
Mod Ports Card Type                              Model              Serial No.
--- ----- -------------------------------------- ------------------ -----------
  1   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     XXXXXXXXXXXX
  2    8  CEF720 8 port 10GE with DFC            WS-X6708-10GE      XXXXXXXXXXXX
  3   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     XXXXXXXXXXXX
  4   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX    XXXXXXXXXXXX
  5    5  Supervisor Engine 720 10GE (Active)    VS-S720-10G      XXXXXXXXXXXX
  6    5  Supervisor Engine 720 10GE (Hot)       VS-S720-10G        XXXXXXXXXXXX
  7   16  CEF720 16 port 10GE                    WS-X6716-10GE      XXXXXXXXXXXX
  8   16  CEF720 16 port 10GE                    WS-X6716-10GE      XXXXXXXXXXXX

Mod MAC addresses                       Hw    Fw           Sw           Status
--- ---------------------------------- ------ ------------ ------------ -------
  1  0023.5e7f.4ac0 to 0023.5e7f.4aef   3.0   12.2(18r)S1  12.2(33)SXI6 Ok
  2  001e.f7f8.21e8 to 001e.f7f8.21ef   1.4   12.2(18r)S1  12.2(33)SXI6 Ok
  3  0012.4376.c1d0 to 0012.4376.c1ff   2.1   Unknown      Unknown      PwrDeny
  4  0021.55df.1ed0 to 0021.55df.1eff   2.8   12.2(18r)S1  12.2(33)SXI6 Ok
  5  0025.84bf.7b08 to 0025.84bf.7b0f   3.1   8.5(3)       12.2(33)SXI6 Ok
  6  001e.4a7e.e468 to 001e.4a7e.e46f   3.1   8.5(3)       12.2(33)SXI6 Ok
  7  e05f.b974.a680 to e05f.b974.a68f   1.0   12.2(18r)S1  12.2(33)SXI6 Ok
  8  e05f.b974.a860 to e05f.b974.a86f   1.0   Unknown      Unknown      PwrDeny

Mod  Sub-Module                  Model              Serial       Hw     Status
---- --------------------------- ------------------ ----------- ------- -------
  1  Distributed Forwarding Card WS-F6700-DFC3B     SAL12437YGQ  4.7    Ok
  2  Distributed Forwarding Card WS-F6700-DFC3C     SAL1223SNM7  1.0    Ok
  3  Centralized Forwarding Card WS-F6700-CFC       SAD0843019H  2.0    PwrDeny
  4  Distributed Forwarding Card WS-F6700-DFC3B     SAL1219Q4TH  4.6    Ok
  5  Policy Feature Card 3       VS-F6K-PFC3C       SAL1407B9EV  1.1    Ok
  5  MSFC3 Daughterboard         VS-F6K-MSFC3       SAL1407BJ77  2.1    Ok
  6  Policy Feature Card 3       VS-F6K-PFC3C       SAL1408BN6M  1.1    Ok
  6  MSFC3 Daughterboard         VS-F6K-MSFC3       SAL1407BFWL  2.1    Ok
  7  Distributed Forwarding Card WS-F6700-DFC3C     SAL15139YZ9  1.4    Ok
  8  Distributed Forwarding Card WS-F6700-DFC3C     SAL1513A3BP  1.4    PwrDeny

Mod  Online Diag Status
---- -------------------
  1  Pass
  2  Pass
  3  Not Applicable
  4  Pass
  5  Pass
  6  Pass
  7  Pass
  8  Not Applicable

Confirming The Current Mode:
6509E_BURN_IN#show power redundancy-mode
system power redundancy mode = redundant

Changing The Power Mode:
6509E_BURN_IN(config)#power redundancy-mode combined
6509E_BURN_IN(config)#
6509E_BURN_IN(config)#end
!
6509E_BURN_IN#show power redundancy-mode
system power redundancy mode = combined



 

 

Capturing 802.11 Frames in Wireshark

Figured I would pass this along. I started reading chapter 15 in the CCNP Switch certification Guide; Integrating Wireless LANs. While reading the first few pages, I quickly wanted to get a sniffer out and check out all of these 802.11 frame specifications that it references.

Some examples are DIFS(duration timer) and the random back off timer.  I decided to fire up Wireshark, but the frames kept appearing as 802.3(Ethernet) frames. This is known as "fake" Ethernet headers. Unfortunately, with the current WIFI card installed in my laptop, I won’t be able to sniff  802.11 traffic.  

Per Wire Shark:
Without any interaction, capturing on WLAN's may capture only user datapackets with "fake" Ethernet headers. In this case, you won't see any 802.11 management or control packets at all, and the 802.11 packet headers are "translated" by the network driver to "fake" Ethernet packet headers.

http://wiki.wireshark.org/CaptureSetup/WLAN

You can also download a 802.11 capture and learn how to read it by following this document.

http://www.cse.ust.hk/~muppala/csit5610/labs/Wireshark_labs/Wireshark_802_11.pdf


 

Keeping Current as a Network Engineer & Working your way to becoming a Network Architect

Keeping Current:
It’s crucial to always stay current in any industry that you work in. You want to be the one bringing new ideas to the table and possibly have new solutions to common problems that companies face. Some of the following websites I follow to keep myself current in the Network Industry along with the Data Center Industry are below.

http://www.datacenterknowledge.com/
 
http://www.networkworld.com/topics/lan-wan.html

Certifications are also a great way to keep current and enhance your skill sets.

Working your way to becoming a Network Architect:
My long term goal is to become a Network Architect and I have found that reading a ton of White Papers along with test results from third party vendors is going to greatly help me achieve this goal. Cisco puts out some great white papers on proven design guides that I highly recommend for anyone to read. The following link is a perfect example and yes I read the entire white paper along with others.

http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html

This has helped me tremendously in being able to design a better network and with my CCNP studies. Cisco also has another great resource, it’s called Cisco Validated Design Program. Check out the following link, its design guides for pretty much every type of network. These are proven and tried design guides from true industry experts.

http://www.cisco.com/en/US/netsol/ns741/networking_solutions_program_home.html

Reading benchmark or test results is another great way to get a key understanding on how to evaluate a product before you buy it and what to look for in new hardware.  I follow this website and a majority of Vendors put third party evaluation results on their own website.

http://www.networktest.com/

9 Common Spanning Tree Mistakes

Great read on STP common mistakes. Article is from 2013.

http://www.networkworld.com/community/blog/9-common-spanning-tree-mistakes?

Interface-Range Command on Non Contiguous Ports

Ever needed to make changes to multiple interfaces that are not within the same range? I know I have and always wondered how to update interfaces that were not sequntially ordered. Here is how.

We need to create a macro and then invoke it before we apply our changes.

Creating the macro:

Cisco_4948E_01#config t
Cisco_4948E_01(config) define interface-range joel GigabitEthernet1/20 , GigabitEthernet1/22 , GigabitEthernet1/24

Invoking the Macro: This now put us into interface configuration mode

Cisco_4948E_01(config)#interface range macro joel
Cisco_4948E_01(config-if-range)#
Cisco_4948E_01(config-if-range)#description macro-test

Verification that our change were successful:

Cisco_4948E_01#show interfaces description | include macro-test
Gi1/20                         down           down     macro-test
Gi1/22                         down           down     macro-test
Gi1/24                         down           down     macro-test

Spanning-Tree Customization - Port Cost & Port Priority

We are going to review how to modify STA(Spanning Tree Algorithm) selection. We are going to use figure 1 for this.

Figure 1

Keep the following STP Rules in mind that will be used to choose a path:

1. Lowest Bridge ID -
2. Lowest root path cost
3. Lowest sender bridge ID
4. Lowest sender port ID

Based on the below output we can see that the root port for vlan 25 is Gi1/47. Let supposed we wanted to use Gi1/48 instead of Gi1/47. How would we do this? We would need to modify the port cost on Switch 02 or modify the port priority that we are receiving from 01.  In our case we will modify the port cost on Switch 02 for Gi1/48.  The port cost is related to the port bandwidth. If you have a 10Mbit port then the port cost will be higher. Its an inverse affect.


Cisco_4948E_02#show spanning-tree vlan 25

VLAN0025
  Spanning tree enabled protocol rstp
  Root ID    Priority    32793
             Address     4055.39a7.bb80
             Cost        4
             Port        47 (GigabitEthernet1/47)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32793  (priority 32768 sys-id-ext 25)
             Address     4055.39a8.1000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/47              Root FWD 4         128.47   P2p
Gi1/48              Altn BLK 4         128.48   P2p


Lets make our changes and confirm Gi1/48 is now being used as the root port.

Cisco_4948E_02(config)#int gi 1/48
Cisco_4948E_02(config-if)#spanning-tree vlan 25 cost 2
Cisco_4948E_02(config-if)#end

Cisco_4948E_02#show spanning-tree vlan 25

VLAN0025
  Spanning tree enabled protocol rstp
  Root ID    Priority    32793
             Address     4055.39a7.bb80
             Cost        2
             Port        48 (GigabitEthernet1/48)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32793  (priority 32768 sys-id-ext 25)
             Address     4055.39a8.1000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/47              Altn BLK 4         128.47   P2p
Gi1/48              Root FWD 2         128.48   P2p

Now lets put everything back to default and we will modify the port-priority on Switch 01 and see how it affects the decision Switch 02 makes. Based on the below output all is back to Normal.

Cisco_4948E_02#show spanning-tree vlan 25

VLAN0025
  Spanning tree enabled protocol rstp
  Root ID    Priority    32793
             Address     4055.39a7.bb80
             Cost        4
             Port        47 (GigabitEthernet1/47)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32793  (priority 32768 sys-id-ext 25)
             Address     4055.39a8.1000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/47              Root FWD 4         128.47   P2p
Gi1/48              Altn BLK 4         128.48   P2p

Lets make some changes on Switch 01, but before we do this lets verify some details to compare afterwards. We can see the port id being received from Switch 01 is 128.47 for Gi1/47 and 128.48 for Gi1/48. We will modify this on Switch 01 and by changing this we will prefer Gi1/48. This will keep us inline with the original goal of using Gi1/48. 

Cisco_4948E_02#show spanning-tree vlan 25 detail

 VLAN0025 is executing the rstp compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, sysid 25, address 4055.39a8.1000
  Configured hello time 2, max age 20, forward delay 15, transmit hold-count 6
  Current root has priority 32793, address 4055.39a7.bb80
  Root port is 47 (GigabitEthernet1/47), cost of root path is 4
  Topology change flag not set, detected flag not set
  Number of topology changes 10 last change occurred 00:32:15 ago
          from GigabitEthernet1/47
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 0, topology change 0, notification 0, aging 300

 Port 47 (GigabitEthernet1/47) of VLAN0025 is root forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.47.
   Designated root has priority 32793, address 4055.39a7.bb80
   Designated bridge has priority 32793, address 4055.39a7.bb80
   Designated port id is 128.47, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 3
   Link type is point-to-point by default
   BPDU: sent 10, received 1362

 Port 48 (GigabitEthernet1/48) of VLAN0025 is alternate blocking
   Port path cost 4, Port priority 128, Port Identifier 128.48.
   Designated root has priority 32793, address 4055.39a7.bb80
   Designated bridge has priority 32793, address 4055.39a7.bb80
   Designated port id is 128.48, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 4
   Link type is point-to-point by default
   BPDU: sent 14, received 88569


Cisco_4948E_01(config)#int gi 1/47
Cisco_4948E_01(config-if)#spanning-tree port-priority 32
Cisco_4948E_01(config-if)#int gi 1/48
Cisco_4948E_01(config-if)#spanning-tree port-priority 16
Cisco_4948E_01(config-if)#endCisco_4948E_02#show spanning-tree vlan 25 detail

 VLAN0025 is executing the rstp compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, sysid 25, address 4055.39a8.1000
  Configured hello time 2, max age 20, forward delay 15, transmit hold-count 6
  Current root has priority 32793, address 4055.39a7.bb80
  Root port is 48 (GigabitEthernet1/48), cost of root path is 4
  Topology change flag set, detected flag not set
  Number of topology changes 11 last change occurred 00:00:02 ago
          from GigabitEthernet1/48
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 0, topology change 32, notification 0, aging 300

 Port 47 (GigabitEthernet1/47) of VLAN0025 is alternate blocking
   Port path cost 4, Port priority 128, Port Identifier 128.47.
   Designated root has priority 32793, address 4055.39a7.bb80
   Designated bridge has priority 32793, address 4055.39a7.bb80
   Designated port id is 32.47, designated path cost 0
   Timers: message age 15, forward delay 0, hold 0
   Number of transitions to forwarding state: 3
   Link type is point-to-point by default
   BPDU: sent 10, received 1400

 Port 48 (GigabitEthernet1/48) of VLAN0025 is root forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.48.
   Designated root has priority 32793, address 4055.39a7.bb80
   Designated bridge has priority 32793, address 4055.39a7.bb80
   Designated port id is 16.48, designated path cost 0
   Timers: message age 15, forward delay 0, hold 0
   Number of transitions to forwarding state: 5
   Link type is point-to-point by default
   BPDU: sent 16, received 88606

Cisco_4948E_02#
 
 Cisco_4948E_02#show spanning-tree vlan 25

VLAN0025
  Spanning tree enabled protocol rstp
  Root ID    Priority    32793
             Address     4055.39a7.bb80
             Cost        4
             Port        48 (GigabitEthernet1/48)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32793  (priority 32768 sys-id-ext 25)
             Address     4055.39a8.1000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/47              Altn BLK 4         128.47   P2p
Gi1/48              Root FWD 4         128.48   P2p

Spanning Tree (STP 802.1d and RSTP 802.1w) Debug & Notes

I am going to simulate a failure scenario while running 802.1d and then while running 802.1w. Currently Port Gi1/47(Green) and Gi1/48(Red) are configured as trunk ports and are allowing all vlans through. Gi1/48 is in a blocking(ALTN) state for Vlan 25 . I am going to admin down Gi1/47 and Enable debugging so we can see the events that occur. At the same time I will ping from SW01 to SW02 to see how long it takes to converge.

Figure 1

Verifications: 

Cisco_4948E_02#show spanning-tree root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001         20481 4055.39a8.1000         0    2   20  15
VLAN0025         32793 4055.39a7.bb80         4    2   20  15  Gi1/47
VLAN0026         32794 4055.39a8.1000         0    2   20  15
VLAN0052         32820 4055.39a8.1000         0    2   20  15

Cisco_4948E_02#show spanning-tree vlan 25

VLAN0025
  Spanning tree enabled protocol ieee
  Root ID    Priority    32793
             Address     4055.39a7.bb80
             Cost        4
             Port        47 (GigabitEthernet1/47)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32793  (priority 32768 sys-id-ext 25)
             Address     4055.39a8.1000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/47              Root FWD 4         128.47   P2p
Gi1/48              Altn BLK 4         128.48   P2p


Cisco_4948E_02#

Enable Debugging & Setup Ping:

Cisco_4948E_02#debug spanning-tree events
Spanning Tree event debugging is on
!
Cisco_4948E_02#terminal monitor
Cisco_4948E_02#

Cisco_4948E_01#ping 192.168.25.2 repeat 100000 timeout 5

Fail Over: 
Now we shutdown Gi1/47 while running 802.1d.





 Cisco_4948E_02(config)#int gi 1/47
Cisco_4948E_02(config-if)#shut
Cisco_4948E_02(config-if)#
*Nov 23 11:51:10.423: STP: VLAN0025 new root port Gi1/48, cost 4
*Nov 23 11:51:10.423: STP: VLAN0025 Gi1/48 -> listening
*Nov 23 11:51:12.419: %HSRP-5-STATECHANGE: Vlan25 Grp 25 state Standby -> Init
*Nov 23 11:51:12.423: STP: VLAN0025 sent Topology Change Notice on Gi1/48
*Nov 23 11:51:13.331: STP: VLAN0001 Topology Change rcvd on Gi1/48
*Nov 23 11:51:13.331: STP: VLAN0026 Topology Change rcvd on Gi1/48
*Nov 23 11:51:25.423: STP: VLAN0025 Gi1/48 -> learning
*Nov 23 11:51:40.423: STP: VLAN0025 Gi1/48 -> forwarding
*Nov 23 11:52:05.347: %HSRP-5-STATECHANGE: Vlan25 Grp 25 state Speak -> Standby

 Results:

It took forty seconds for spanning tree to converge. This can be seen from the below ping output which was set with a time out of 5 seconds.  By default it can take up to 50 seconds plus any additional time it takes your first hop redundancy protocols.

!!!!!!!........!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!
Success rate is 99 percent (9246/9254), round-trip min/avg/max = 1/1/28 ms
Cisco_4948E_01#

Lets do the same test while running 802.1w and all timers are default.

 Cisco_4948E_02#show spanning-tree root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0001         20481 4055.39a8.1000         0    2   20  15
VLAN0025         32793 4055.39a7.bb80         4    2   20  15  Gi1/47
VLAN0026         32794 4055.39a8.1000         0    2   20  15
VLAN0052         32820 4055.39a8.1000         0    2   20  15
Cisco_4948E_02#show spanning-tree vlan 25

VLAN0025
  Spanning tree enabled protocol rstp
  Root ID    Priority    32793
             Address     4055.39a7.bb80
             Cost        4
             Port        47 (GigabitEthernet1/47)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32793  (priority 32768 sys-id-ext 25)
             Address     4055.39a8.1000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/47              Root FWD 4         128.47   P2p
Gi1/48              Altn BLK 4         128.48   P2p


Cisco_4948E_02(config-if)#
*Nov 23 14:13:30.643: RSTP(25): updt roles, root port Gi1/47 going down
*Nov 23 14:13:30.643: RSTP(25): Gi1/48 is now root port


Cisco_4948E_01#ping 192.168.25.2 repeat 100000 timeout 2

Type escape sequence to abort.
Sending 100000, 100-byte ICMP Echos to 192.168.25.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!
Success rate is 99 percent (984/985), round-trip min/avg/max = 1/1/16 ms
Cisco_4948E_01#

Since RSTP is much faster then legacy STP I set the timeout for 2 seconds. We can see that it converges well within 2 seconds. Compare that to the 40 seconds we waited for legacy STP.

Notes:

Default 802.1d Timers and States:
Disabled: Port is admin down.
Blocking: Port is up but not building the cam table or forwarding any frames via this interface.
Max Age: 20 Seconds -  How long the bridge(Switch) should wait before it stops hearings hellos.
Listening: 15 Seconds - Receiving BPDU's but not building the cam(MAC) table.
Learning: 15 Seconds -Starts building the cam (MAC) table.
Forwarding: Processing Frames.
Legacy Spanning Tree - The root bridge controls the forwarding delay as it is responsible for sending out BPDU.

Data rate	STP Cost (802.1D-1998)
4 Mbit/s	250
10 Mbit/s	100
16 Mbit/s	62
100 Mbit/s	19
1 Gbit/s	4
2 Gbit/s	3
10 Gbit/s	2
Data rate	RSTP Cost (802.1D-2004 / 802.1w)[3]
4 Mbit/s	5,000,000
10 Mbit/s	2,000,000
16 Mbit/s	1,250,000
100 Mbit/s	200,000
1 Gbit/s	20,000
2 Gbit/s	10,000
10 Gbit/s	2,000

Installing a new Cisco ASA-5520 & Creating Secure Networks

I decided to add a Cisco ASA 5520 to my lab. We will use figure 1 to visualize this. I am going to Guide you on how to this and actually route some packets through it. I have only done minor configurations on an ASA before hand, never to this extent. I created two networks, 10.50.51.0/24 and 10.50.52.0/24 for this lab. These are what I will call secure networks. All communication between these two networks must traverse the Firewall.

Figure 1

On 4948_01 I created VLAN 51 (10.50.51.0/24) and on 4948_02, I created VLAN 52. All communication between these two networks must traverse the Firewall. I have seen this used in networks as it was a security requirement by the infosec guys. I also could of created both vlans on one switch and still routed the traffic via the firewall. Some people might use Vlan ACLS  to secure communications between two vlans, but lets say that for this we had a requirement to use a Firewall. Additionally, the networks had two live on two separate switches.

Lets create the Vlan on the switches and SVI along with assigning IP addresses.

Cisco_4948E_01#

vlan 51
 name secure_network_10.50.51.0
!
interface Vlan51
ip address 10.50.51.254 255.255.255.0
no shut

Cisco_4948E_02#

vlan 52
name secure_network_10.50.52.0
!
interface Vlan52
ip address 10.50.52.254 255.255.255.0
no shut

Now we need to add the firewall into the mix. For this I connected one cable from each 4948(Gi1/46) to the ASA_5520.  I made the interfaces on the 4948's routed(L23). I also defined a static route to point to the opposite network. By the way, I used named static routes, a few weeks or months from now you might not remember why you put in that static route. When possible, use them..

Cisco_4948E_01

interface GigabitEthernet1/46
description ASA_GigabitEthernet0/3
no switchport
ip address 192.168.1.1 255.255.255.252
exit
!
ip route 10.50.52.0 255.255.255.0 GigabitEthernet1/46 192.168.1.2 name secure_network
!

Cisco_4948E_02

interface GigabitEthernet1/46
description ASA_GigabitEthernet0/2
no switchport
ip address 192.168.1.5 255.255.255.252
!
ip route 10.50.51.0 255.255.255.0 GigabitEthernet1/46 192.168.1.6 name secure_network
!

This takes care of the switching end of things. Now onto the firewall configuration. First you need to configure your interfaces because the static routes and ACLS will tie into them later. Under each interface you need to assign it a name and ip address. Then you need to assign it a security level. I chose 50 and 100 at random. Security Levels are exactly that. A higher level interface can talk to a lower level interface but not a lower level interface to a higher level interface unless an ACL is define. 

Cisco-ASA5520-01#

 interface GigabitEthernet0/2
 description Cisco_4948E_02 Gi1/46
 nameif Cisco_4948E_02
 security-level 50
 ip address 192.168.1.6 255.255.255.252

interface GigabitEthernet0/3
 description Cisco_4948E_01 Gi1/46
 nameif Cisco_4948E_01
 security-level 100
 ip address 192.168.1.2 255.255.255.252

Now we need to create an acl and in this case I created a ACL that will permit anything and applied it to the lower level interface per Cisco Rule. The permit any is just for this example, I will harden it later.

Cisco-ASA5520-01#

access-list any permit ip any any Cisco_4948E_02
!
access-group any in interface Cisco_4948E_02

Now we need to tell the ASA how to route the traffic and for this I created static routes. Now lets test.

Cisco-ASA5520-01#


route Cisco_4948E_01 10.50.51.0 255.255.255.0 192.168.1.1 1
route Cisco_4948E_02 10.50.52.0 255.255.255.0 192.168.1.5 1

Success!!!!!

 Cisco_4948E_02#ping 10.50.51.254 source 10.50.52.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.50.51.254, timeout is 2 seconds:
Packet sent with a source address of 10.50.52.254
!!!!!


Cisco_4948E_01#ping 10.50.52.254 source 10.50.51.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.50.52.254, timeout is 2 seconds:
Packet sent with a source address of 10.50.51.254
!!!!!