Answers

Figure 1: Four Switches with Trunks

vtp mode transparent
!
vlan 21
vlan 31
!
spanning-tree mode rapid-pvst
spanning-tree vlan 21 root primary
spanning-tree vlan 31 root secondary
!
! Next interface connects to router R1
interface GigabitEthernet1/0/1
  description R1 G0/1 is the neighbor
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/1
  description Dist2 G1/1/2 is the neighbor
  channel-group 3 mode active
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/2
  description Dist2 G1/1/1 is the neighbor
  channel-group 3 mode active
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
! Note: Port-Channel3 created due to earlier channel-group commands
interface Port-Channel3
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/3
  description Access1 G1/1/1 is the neighbor
  switchport mode dynamic desirable
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/4
  description Access2 G1/1/1 is the neighbor
  switchport mode dynamic desirable
  switchport trunk allowed vlan 21,31

Example 5: Dist1 Config

vtp mode transparent
!
vlan 21
vlan 31
!
spanning-tree mode rapid-pvst
spanning-tree vlan 21 root secondary
spanning-tree vlan 31 root primary
!
interface GigabitEthernet1/1/1
  description Dist1 G1/1/2 is the neighbor
  channel-group 3 mode active
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/2
  description Dist1 G1/1/1 is the neighbor
  channel-group 3 mode active
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
! Note: Port-Channel3 created due to earlier channel-group commands
interface Port-Channel3
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/3
  description Access1 G1/1/2 is the neighbor
  switchport mode trunk
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/4
  description Access2 G1/1/2 is the neighbor
  switchport mode trunk
  switchport trunk allowed vlan 21,31

Example 6: Dist2 Config

vtp mode transparent
!
vlan 21
vlan 31
!
interface GigabitEthernet1/0/11
  switchport mode access
  switchport access vlan 21
  spanning-tree portfast
  spanning-tree bpduguard enable
!
interface GigabitEthernet1/0/21
  switchport mode access
  switchport access vlan 31
  spanning-tree portfast
  spanning-tree bpduguard enable
!
interface GigabitEthernet1/1/1
  description Dist1 G1/1/3 is the neighbor
  switchport mode dynamic desirable
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/2
  description Dist2 G1/1/3 is the neighbor
  switchport mode dynamic desirable
  switchport trunk allowed vlan 21,31

Example 7: Access1 Config

vtp mode transparent
!
vlan 21
vlan 31
!
interface GigabitEthernet1/0/12
  switchport mode access
  switchport access vlan 21
  spanning-tree portfast
  spanning-tree bpduguard enable
!
interface GigabitEthernet1/0/22
  switchport mode access
  switchport access vlan 31
  spanning-tree portfast
  spanning-tree bpduguard enable
!
interface GigabitEthernet1/1/1
  description Dist1 G1/1/4 is the neighbor
  switchport mode dynamic auto
  switchport trunk allowed vlan 21,31
!
interface GigabitEthernet1/1/2
  description Dist2 G1/1/4 is the neighbor
  switchport mode dynamic auto
  switchport trunk allowed vlan 21,31

Example 8: Access2 Config

Commentary

This is a BIG lab – it even has BIG in the title. So how do you sift through the configuration?

Here, in this commentary, I’ll break it down the commentary to match the four separate sections of the lab requirements at the top of the lab. If you prefer a deeper look, you can watch the lab review video, which does the same just in video form, with a little more detail about each step in the configuration process. The video also demonstrates getting the EtherChannel working (tricky in CPT), and demonstrates some of the verification steps.

On to the comments!

VLANs, Access Ports, and VTP

To avoid using VTP, you need to disable VTP on all the switches. That means either a vtp mode transparent or vtp mode off global config command. Turns out that CPT supports only the first of those, so that’s the one you would need to use.

With VTP disabled, you need to configure both the VLANs requested in lab (21 ans 31) on all four switches. You might have though you just needed them on the two access switches. However, for a switch to forward frames in a VLAN, the VLAN must be defined on the switch. So, on all four switches, you would need vlan 21 and vlan 31 commands.

The final tasks for this section of requirements happen on the access ports connected to the PCs. The job: make them act as access ports (switchport mode access), and assign the correct VLAN in each case (switchport access vlan 21, for example).

Switch-to-Switch Trunking

The first task in this section asked you to get familiar with the interfaces used in lab. The lab did not supply interface ID (IID) information, leaving that task to you. You can easily find the information using the CPT user interface. You can also collect the info using the show cdp neighbor command on the various devices. It also asked you to add description commands to the interfaces, describing the neighboring device’s name and IID. I asked for that in the lab just to give you an incentive to figure out all the IIDs.

Feel free to ignore the lab’s sample description commands, or to review all of them, depending on your interest level. Conveniently, if you did as suggested and placed the neighbor’s name and the IID as the first part of the description, you will see that information in the output of the show interfaces status command, under the “Name” heading, which makes it quite useful for easy reference.

For now, focusing on the uplinks (links between distribution and access switches), and ignoring the future EtherChannel between Dist1 and Dist2…

The lab asked you to use as many variations of combinations of the switchport mode command as possible which will also result in both switches operating as trunks. The lab does not dictate which trunks use which combination. There are five trunks to configure, and five working combinations. As long as you used all five combinations, I would consider it correct. They are:

• trunk – trunk
• trunk – dynamic desirable
• trunk – dynamic auto
• dynamic desirable – dynamic desirable
• dynamic desirable – dynamic auto

The lab also asked you to allow traffic for only VLANs 21 and 31 to cross those trunks. CPT supports only one variation of the switchport trunk allowed vlan interface subcommand: The variation explicitly defining the entire list. In this case, you need switchport trunk allowed vlan 21,31.

Dist1 – Dist2 EtherChannel

Assuming you chose to implement the optional EtherChannel, first, let’s discuss how to configure it. You should always configure the physical interfaces with correct and matching settings BEFORE attempting to add the interfaces to an EtherChannel. Sure, you can deal with it if you forget, it’s just easier to get a consistent configuration beforehand. The switch checks several settings to ensure the local interfaces match before bundling those into the same EtherChannel, so it just makes sense to configure those consistently.

In this lab, so far, the only interface subcommands that would need to match are:

• switchport mode (with whatever setting you chose)
• switchport trunk allowed vlan 21,31

So, start with those on the two physical interfaces.

Then, on each physical interface, add the channel-group 3 mode active command. The first occurrence dynamically creates the port-channel interface and copies in the physical interface subcommands as well. Note that you can use different channel-group numbers on Dist1 and Dist2, but the lab suggested using #3.

Note that the active keyword implies using LACP, an IEEE standard. On one end, you must use “active” per the lab instructions. On the other, you could use either “active” or “passive”. (Active initiates the negotiation, passive participates if the other end initiates.)

That gets you through the configuration. However, CPT struggles to make an EtherChannel work after you configure it in config mode. So, you have to work around the problem by saving everything and restarting:

1. Issue a copy running-config startup-config on all switches.
2. In CPT, use file…save to save the .pkt file.
3. Close the CPT app.
4. Once fully closed, open CPT again.
5. Open the .pkt file you just closed.
6. Now verify whether your EtherChannel works.
7. If you need to change the configuration, repeating this process may be more productive than hoping CPT will make the EtherChannel work without the extra effort.

Spanning Tree

The RSTP config focus on remembering the commands and the syntax, as none of the commands have tricky parameters or combinations of related commands. They are:

1. To use RSTP on each switch, add the global config command spanning-tree mode rapid-pvst.
2. To make Dist1 the root switch in VLAN 21, use global config command spanning-tree vlan 21 root primary on Dist1.
3. To make Dist2 the root switch in VLAN 31, use global config command spanning-tree vlan 31 root primary on Dist2.
4. The lab instructions asked for a subcommand, so to enable PortFast on those access ports connected to the PCs, use the spanning-tree portfast interface subcommand.
5. The lab instructions asked for a subcommand, so to enable BPDU guard on those access ports connected to the PCs, use the spanning-tree bpduguard enable interface subcommand.

Known Issues in this Lab

This section of each Config Lab Answers post hopes to help with those issues by listing any known issues with Packet Tracer related to this lab. In this case, the issues are:

Why Would Cisco Packet Tracer Have Issues?

(Note: The below text is the same in every Config Lab.)

Cisco Packet Tracer (CPT) simulates Cisco routers and switches. However, CPT does not run the same software as real Cisco routers and switches. Instead, developers wrote CPT to predict the output a real router or switch would display given the same topology and configuration – but without performing all the same tasks, an actual device has to do. On a positive note, CPT requires far less CPU and RAM than a lab full of devices so that you can run CPT on your computer as an app. In addition, simulators like CPT help you learn about the Cisco router/switch user interface – the Command Line Interface (CLI) – without owning real devices.

CPT can have issues compared to real devices because CPT does not run the same software as Cisco devices. CPT does not support all commands or parameters of a command. CPT may supply output from a command that differs in some ways from what an actual device would give. Those differences can be a problem for anyone learning networking technology because you may not have experience with that technology on real gear – so you may not notice the differences. So this section lists differences and issues that we have seen when using CPT to do this lab.

Beyond comparing your answers to this lab’s Answers post, you can test in Cisco Packet Tracer (CPT). In fact, you can and should explore the lab once configured. For this lab, once you have completed the configuration, try these verification steps. 

First, test basic connectivity, to make sure the lab works.

• A21 and B21 reside in VLAN 21, with A31 and B31 residing in VLAN 31. Pinging from A21 to B21, and from A31 to B31, tests connectivity within VLANs 21 and 31, respectively. Use CPT to discover the device IP addresses and ping the other devices!
• For the PCs in different subnets to ping each other, they rely on the preconfigured router R1 to perform routing, using router-on-a-stick configuration that you may not have learned yet. That function requires configuration on both the router, as well as static trunking configuration on switch Dist1’s connected port, G1/0/1. It is ALL preconfigured. So, if the prior pings within the subnets work, pings between devices in different subnets should now also work. So try it! Ping between each of the four PCs.

Even if all the pings work, verify all the individual features work. You can work through all the lab requirements and think of related show commands. But here are a few suggestions:

• VLANs 21 and 31 must exist on all four switches (show vlan brief)
• All switch-to-switch links should be VLAN trunks (show interfaces trunk)
• All trunk allowed VLAN lists should be limited to VLANs 21 and 31 (show interfaces trunk – look at the first of three lists of VLANs)
• Check which switch is the root switch. On switch Dist1, look for the phrase “This bridge is the root” (show spanning-tree vlan 21), with similar output in Dist2 for VLAN 31.
• Check the portfast and BPDU guard settings on the ports connected to the PCs (show spanning-tree interface gx/y/z detail)
• As for the switch and interface connected at the other end of links, you can find that information from the PT user interface. You can also find it with the show cdp neighbor command, which lists the neighbor’s hostname on the left side of the output and the neighbor’s interface ID (Port ID) on the right side of the output.